|
| 1 | +--- |
| 2 | +title: "Windows AppLocker Exposure of Sensitive Information to an Unauthorized Actor " |
| 3 | +subtitle: "Sample Subtitle" |
| 4 | +date: 2025-05-18 |
| 5 | +author: "Ghostbyt3" |
| 6 | +tags: ["1day", "appid.sys", "windows", "kernel", "privesc"] |
| 7 | +categories: ["1Day Breakdown"] |
| 8 | +authorbox: true |
| 9 | +pager: true |
| 10 | +toc: true |
| 11 | +sidebar: "right" |
| 12 | +layout: "single" |
| 13 | +showTableOfContents: true |
| 14 | +--- |
| 15 | + |
| 16 | +CVE-2024-38041 is a information leak vulnerability in the Windows AppID driver (`appid.sys`). The flaw lies in the handler for IOCTL code `0x22A014`, which lacks proper validation of the caller's access mode. Specifically, the `AipDeviceIoControlDispatch` function does not verify that the request originates from kernel mode. As a result, a user-mode process running as LOCAL SERVICE can trigger this IOCTL to leak kernel pointers via a shared SystemBuffer. By impersonating the LOCAL SERVICE account and invoking the vulnerable IOCTL, an attacker can leak kernel addresses, bypassing KASLR and paving the way for further kernel exploitation. |
| 17 | + |
| 18 | +**Title:** Windows Kernel Information Disclosure Vulnerability |
| 19 | +**CVE-2024-38041:** https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38041 |
| 20 | +**Vulnerability Type:** Exposure of Sensitive Information to an Unauthorized Actor |
| 21 | +**Tested On:** Windows 11 23H2 |
| 22 | +**Driver Version:** appid.sys - 10.0.22621.3155 |
| 23 | + |
| 24 | + |
| 25 | +## Requirements |
| 26 | + |
| 27 | +To send the IOCTL request, the IOCTL code was examined and found to have the access flag set to `FILE_WRITE_ACCESS`. This means the I/O manager will dispatch the IRP only if the caller has write access rights. |
| 28 | + |
| 29 | + |
| 30 | + |
| 31 | +The device’s security descriptor was checked to determine which users have permission to open a handle. It was observed that only the `AppIDSvc` and `LOCAL SERVICE` accounts have full access and `Administrator` does not. As a result, a `cmd.exe` session must be run under one of these two accounts to interact with and exploit the device. |
| 32 | + |
| 33 | + |
| 34 | + |
| 35 | +One of the simplest methods to achieve this is by using `PsExec.exe` to spawn a shell as the `LOCAL SERVICE` user. |
| 36 | + |
| 37 | + |
| 38 | + |
| 39 | +## Vulnerability analysis |
| 40 | + |
| 41 | +The IOCTL request sent to `0x22A014` first checks whether the `OutputBufferLength` is exactly 48 bytes. If the length does not match, the operation exits with an error. If the condition is met, the driver copies certain kernel addresses and function pointers into the `SystemBuffer`. Since this IOCTL uses `METHOD_BUFFERED`, both input and output are shared via `IRP->AssociatedIrp.SystemBuffer`. As a result, this behavior leads to a kernel address leak. |
| 42 | + |
| 43 | +```c++ |
| 44 | +__int64 __fastcall AipDeviceIoControlDispatch(struct _DEVICE_OBJECT *a1, IRP *_IRP) |
| 45 | +{ |
| 46 | + |
| 47 | + |
| 48 | +[::] |
| 49 | + case 0x22A014: |
| 50 | + if ( WPP_GLOBAL_Control != (PDEVICE_OBJECT)&WPP_GLOBAL_Control && (HIDWORD(WPP_GLOBAL_Control->Timer) & 2) != 0 ) |
| 51 | + WPP_SF_( |
| 52 | + (__int64)WPP_GLOBAL_Control->AttachedDevice, |
| 53 | + 0x1Au, |
| 54 | + (__int64)&WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); |
| 55 | + if ( CurrentStackLocation->Parameters.DeviceIoControl.OutputBufferLength != 48 ) |
| 56 | + goto LABEL_27; |
| 57 | + SystemBuffer = IRP->AssociatedIrp.SystemBuffer; |
| 58 | + *SystemBuffer = &Resource; |
| 59 | + SystemBuffer[1] = &xmmword_1C00168A8; |
| 60 | + SystemBuffer[2] = (char *)&xmmword_1C00168A8 + 8; |
| 61 | + SystemBuffer[3] = &qword_1C00168B8; |
| 62 | + SystemBuffer[4] = AiReleaseOriginProcessData; |
| 63 | + SystemBuffer[5] = AiAllocUninstallStringData; |
| 64 | + IRP->IoStatus.Information = 48LL; |
| 65 | + |
| 66 | +[::] |
| 67 | +} |
| 68 | +``` |
| 69 | +
|
| 70 | +## Exploit |
| 71 | +
|
| 72 | +Tested on: Windows 11 22H2 (01-2024 Build) |
| 73 | +Working POC: https://github.com/ghostbyt3/WinDriver-EXP/tree/main/CVE-2024-38041/POC |
| 74 | +
|
| 75 | +``` |
| 76 | +PS C:\Users\h4x\Desktop> .\CVE-2024-38041.exe -p 1544 |
| 77 | +[+] Trying to find Thread ID for the given process PID: 1544 |
| 78 | +[+] First Thread ID of the process: 1548 |
| 79 | +[+] Opened a THREAD_DIRECT_IMPERSONATION handle to the LOCAL_SERVICE process |
| 80 | +[+] Opening handle to Applocker device |
| 81 | +[+] Calling AipDeviceIoControlDispatch ....success |
| 82 | +[+] Leaked Kernel Address: |
| 83 | + [*] Value0: 0xFFFFF80180C96820 |
| 84 | + [*] Value1: 0xFFFFF80180C96888 |
| 85 | + [*] Value2: 0xFFFFF80180C96890 |
| 86 | + [*] Value3: 0xFFFFF80180C96898 |
| 87 | + [*] Value4: 0xFFFFF80180C9D250 |
| 88 | + [*] Value5: 0xFFFFF80180C9C570 |
| 89 | +``` |
| 90 | +
|
| 91 | +## Patch |
| 92 | +
|
| 93 | +In the patched version, a call to `ExGetPreviousMode()` ensures only kernel-mode callers can proceed, blocking this path. |
| 94 | +
|
| 95 | +```c++ |
| 96 | +__int64 __fastcall AipDeviceIoControlDispatch(struct _DEVICE_OBJECT *a1, IRP *_IRP) |
| 97 | +{ |
| 98 | +
|
| 99 | +
|
| 100 | +[::] |
| 101 | +
|
| 102 | + if ( WPP_GLOBAL_Control != (PDEVICE_OBJECT)&WPP_GLOBAL_Control && (HIDWORD(WPP_GLOBAL_Control->Timer) & 2) != 0 ) |
| 103 | + WPP_SF_( |
| 104 | + (__int64)WPP_GLOBAL_Control->AttachedDevice, |
| 105 | + 0x1Au, |
| 106 | + (__int64)&WPP_a52c6a01ee1136c5e851ebb08df688b5_Traceguids); |
| 107 | + if ( (unsigned int)Feature_2619781439__private_IsEnabledDeviceUsage() && ExGetPreviousMode() ) // Fix |
| 108 | + goto LABEL_19; |
| 109 | + if ( *(_DWORD *)(v5 + 8) != 48 ) |
| 110 | + goto LABEL_28; |
| 111 | + v11 = *(PVOID ***)(a2 + 24); |
| 112 | + *v11 = &WPP_MAIN_CB.Reserved; |
| 113 | + v11[1] = (PVOID *)&xmmword_1C0016888; |
| 114 | + v11[2] = (PVOID *)&xmmword_1C0016888 + 1; |
| 115 | + v11[3] = (PVOID *)&qword_1C0016898; |
| 116 | + v11[4] = (PVOID *)AiReleaseOriginProcessData; |
| 117 | + v11[5] = (PVOID *)AiAllocUninstallStringData; |
| 118 | + *(_QWORD *)(a2 + 56) = 48LL; |
| 119 | +
|
| 120 | +[::] |
| 121 | +
|
| 122 | +} |
| 123 | +``` |
| 124 | + |
| 125 | +## Acknowledgements |
| 126 | + |
| 127 | +- It was explained by CSACyber and can be found [here](https://csacyber.com/blog/exploiting-microsoft-kernel-applocker-driver-cve-2024-38041). |
| 128 | +- The [PoC](https://github.com/varwara/CVE-2024-38041/) was developed by Varwara, and the above PoC is based on it. |
0 commit comments