Pierluigi Paganini August 19, 2024

Microsoft addressed a zero-day vulnerability actively exploited by the North-Korea-linked Lazarus APT group.

Microsoft has addressed a zero-day vulnerability, tracked as CVE-2024-38193 (CVSS score: 7.8), which has been exploited by the North Korea-linked Lazarus APT group.

The vulnerability, tracked as CVE-2024-38193 (CVSS score: 7.8), is a privilege escalation issue that resides in the Windows Ancillary Function Driver (AFD.sys) for WinSock.

Microsoft addressed the vulnerability with Path Tuesday security updates released in August 2024, the IT giant also warned that the flaw was exploited in attacks in the wild.

An attacker can exploit this vulnerability to gain SYSTEM privileges, the flaw was reported by Luigino Camastra and Milánek with Gen Digital.

“Gen Threat Labs recently uncovered and reported a major security flaw known as a zero-day vulnerability (CVE-2024-38193), which Microsoft has now fixed. This repair is important because it addresses a security issue that was being used by the Lazarus APT group, a North Korean hacker group known for targeting specific professionals.” reads the post published by Gen Digital.

In early June, Gen Digital researchers discovered that the North Korea-linked APT Lazarus was exploiting a zero-day in the AFD.sys driver to gain unauthorized access to sensitive system areas. The attackers used a “special type of malware” called Fudmodule to avoid detection. 

“The vulnerability allowed attackers to bypass normal security restrictions and access sensitive system areas that most users and administrators can’t reach. This type of attack is both sophisticated and resourceful, potentially costing several hundred thousand dollars on the black market.” continues the report. “This is concerning because it targets individuals in sensitive fields, such as those working in cryptocurrency engineering or aerospace to get access to their employer’s networks and steal crypto currencies to fund attackers’ operations.”

In February 2024, Avast discovered an in-the-wild exploit for a previously unknown zero-day vulnerability in the AppLocker driver (appid.sys). Microsoft quickly fixed this vulnerability, now tracked as CVE-2024-21338, in the February Patch Tuesday update. The Lazarus Group exploited the zero-day to gain kernel-level access and disable security software. In past attacks threat actors achieved the same goal by using much noisier BYOVD (Bring Your Own Vulnerable Driver) techniques to cross the admin-to-kernel boundary. 

Lazarus exploited the vulnerability CVE-2024-21338 to perform direct kernel object manipulation in an updated version of their FudModule rootkit.

“the holy grail of admin-to-kernel is going beyond BYOVD by exploiting a zero-day in a driver that’s known to be already installed on the target machine. To make the attack as universal as possible, the most obvious target here would be a built-in Windows driver that’s already a part of the operating system.” reads the analysis published by Avast.

“Discovering an exploitable vulnerability in such a driver is significantly more challenging than in the previous BYOVD scenarios for two reasons. First, the number of possible target drivers is vastly smaller, resulting in a much-reduced attack surface. Second, the code quality of built-in drivers is arguably higher than that of random third-party drivers, making vulnerabilities much more difficult to find.” 

The new version of the rootkit can suspend PPL (Protected Process Light) protected processes associated with Microsoft Defender, CrowdStrike Falcon, and HitmanPro. 

The flaw CVE-2024-21338 resides within the IOCTL (Input and Output Control) dispatcher of the driver appid.sys. This driver is a core component of the AppLocker application, which is used to control which apps and files users can run. 

Lazarus exploited the zero-day in the appid.sys driver by manipulating the Input and Output Control (IOCTL) dispatcher. This manipulation allows them to arbitrary code on the target system, bypassing security measures.

“The entire goal of the admin-to-kernel exploit was to corrupt the current thread’s PreviousMode. This allows for a powerful kernel read/write primitive, where the affected user-mode thread can read and write arbitrary kernel memory using the Nt(Read|Write)VirtualMemory syscalls. Armed with this primitive, the FudModule rootkit employs direct kernel object manipulation (DKOM) techniques to disrupt various kernel security mechanisms. It’s worth reiterating that FudModule is a data-only rootkit, meaning it executes entirely from user space and all the kernel tampering is performed through the read/write primitive.” reads the report.

With their valuable admin-to-kernel zero-day exposed, Lazarus’s ability to bypass security has been significantly hampered. They must now choose between finding a new critical exploit or reverting to their older, less potent BYOVD tactics

The researchers noticed that with their valuable admin-to-kernel zero-day exposed, Lazarus’s ability to bypass security has been significantly hampered. They must now choose between finding a new critical exploit or reverting to their older, less potent BYOVD tactics.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – OpenAI, Lazarus)