Unpacking CVE-20 — What It

Unpacking CVE-20 reveals an elevation of privilege vulnerability in the Windows kernel. This flaw allows a low-privileged local attacker to gain SYSTEM privileges on a vulnerable system. The vulnerability, officially identified as CVE-2024-21338, carries a CVSS 3.1 Base Score of 7.8, rated as high severity (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation grants kernel-level code execution, enabling attackers to disable security products, tamper with kernel objects, and achieve full host compromise. Microsoft confirmed the vulnerability affects supported versions of Windows 10 (1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server (2019, 2022, and 2022 23H2 Edition). CISA added this issue to its Known Exploited Vulnerabilities catalog on March 4, 2024, reflecting active exploitation in the wild.

Unpacking CVE-20: Technical Root Cause Analysis

The core of this vulnerability resides within the Windows AppLocker driver, appid.sys. The driver exposes an Input/Output Control (IOCTL) interface to user mode. Specifically, the control code 0x22A018 is vulnerable. This IOCTL is designed to compute a smart hash of an executable image file. The flaw stems from improper validation of an attacker-controlled input used to compute a function pointer inside the driver. This allows an attacker to supply a crafted input that causes the driver to invoke an arbitrary routine in kernel context. The Common Weakness Enumeration (CWE) classifies this as CWE-822, an Untrusted Pointer Dereference.

Exploitation Mechanics

Exploitation of this vulnerability requires an attacker to first gain local authenticated access to the system. This often means the attacker already has administrative rights on the host or has compromised a user account. The attacker then opens a handle to the AppLocker driver's device object, typically identified as \\Device\\AppID. A specially crafted IOCTL request, using the vulnerable control code 0x22A018, is then sent to the driver.

The crafted input buffer manipulates internal driver logic. It corrupts the PreviousMode field within the _KTHREAD thread context. The PreviousMode field determines if a direct syscall (e.g., Nt, Zw functions) originates from the kernel or user mode. By setting this field to 0, an attacker can then call direct syscalls like NtReadVirtualMemory or NtWriteVirtualMemory from user mode, affecting kernel addresses. This provides a powerful kernel read/write primitive, enabling the attacker to achieve SYSTEM-level privileges. This method is significant because it exploits a driver already present on the system, moving beyond typical "Bring Your Own Vulnerable Driver" (BYOVD) tactics. The Lazarus Group has actively exploited this vulnerability in the wild, using it to deploy the FudModule rootkit.

Detection: How to Check if You're Affected

Detecting successful exploitation of Unpacking CVE-20 requires diligent system monitoring. Your primary defense involves verifying patch installation. Use the wmic qfe list command or check the Update History UI to confirm the February 2024 Microsoft security updates are present.

wmic qfe list full /format:htable > hotfixes.html
start hotfixes.html

Monitor for anomalous parent-child process relationships and unexpected kernel-level activity. Look for user-mode processes attempting to open handles to the AppLocker device object, specifically \\.\AppId or \Device\AppID, outside of normal Microsoft-signed services. Endpoint Detection and Response (EDR) solutions should flag suspicious processes executing with SYSTEM privileges, especially if spawned from user-level accounts. Pay attention to any unexpected disabling of security services like antivirus or EDR solutions, as this is a common post-exploitation action. Log analysis should include searches for specific command-line arguments targeting the appid.sys driver. The presence of the FudModule rootkit or other unsigned kernel modules loaded shortly after suspicious IOCTL traffic is a strong indicator of compromise.

For external-facing Windows servers, such as those hosting Outlook Web Access (OWA) or Exchange Control Panel (ECP), understanding your attack surface is critical. Use a free website vulnerability scanner to identify common web application flaws that could lead to initial access. These scanners assess your web applications against OWASP Top 10 risks, providing insights into potential entry points. Additionally, a free port scanner helps identify all open ports and the services running on them. If administrative interfaces like RDP or other management services are publicly exposed, they significantly increase the risk of an attacker gaining the initial local access needed to exploit Unpacking CVE-20. Secably offers these tools for instant, no-signup checks. For continuous monitoring and deeper insights into your attack surface, explore Secably pricing for paid plans, starting at $19/month.

Remediation Steps

Immediate action is necessary to mitigate CVE-2024-21338. Apply the February 2024 Microsoft security updates to all affected Windows 10, Windows 11, and Windows Server systems without delay. Prioritize patching on internet-exposed servers, jump hosts, and developer workstations where local administrator access is common. No supported workaround exists; Microsoft requires installation of the security update to remediate the flaw.

Beyond patching, enforce the principle of least privilege across your environment. Restrict local administrative accounts to only those users and services that absolutely require them. Implement application whitelisting where feasible, even though AppLocker is tied to the vulnerability, to limit unauthorized code execution. Educate users on phishing attacks and suspicious software installations to prevent initial system compromise, as local access is a prerequisite for exploiting this vulnerability. For more details on this and related threats, refer to our Deep Dive Into Unpacking CVE-20 blog post.

Timeline of Disclosure

• August 2023: Avast researchers developed a custom Proof of Concept (PoC) exploit and submitted it to Microsoft as part of a vulnerability report.
• February 13, 2024: Microsoft publicly disclosed CVE-2024-21338 as part of its Patch Tuesday updates. Security updates addressing the vulnerability were released simultaneously.
• February 28, 2024: Avast published detailed research on the in-the-wild exploitation of CVE-2024-21338 by the Lazarus Group. Microsoft subsequently revised its "Exploitability assessment" for the flaw to "Exploitation Detected."
• March 4, 2024: CISA added CVE-2024-21338 to its Known Exploited Vulnerabilities Catalog.