High‑Severity Kernel‑Mode Driver Untrusted Pointer Dereference (CVE‑2024‑35250) Enables Privilege Escalation on Windows
What It Is
CVE‑2024‑35250 is a flaw in a Microsoft Windows kernel‑mode driver where an untrusted pointer can be dereferenced. The bug permits a locally‑executed malicious payload to run with SYSTEM‑level privileges, effectively bypassing the operating system’s access‑control boundary.
Exploitability
The vulnerability is rated High (CVSS ≥ 7.0). It is a local privilege‑escalation issue; no remote exploit is required. Proof‑of‑concept code has been released publicly, and the vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
Affected Products
- Microsoft Windows (client and server editions that include the vulnerable kernel‑mode driver).
- All supported versions that have not yet received the corrective update.
Why It Matters for Compliance & Audit Readiness
Privilege‑escalation flaws directly undermine access‑control assurances required by frameworks such as NIST 800‑53 AC‑2/AC‑6 and ISO 27001 A.9.2. Maintaining a defensible audit trail demands that organizations demonstrate timely remediation of high‑severity local escalation vectors. Evidence of patch deployment, updated privileged‑account monitoring, and documented control‑mapping to the “Access Control” domain are essential for continuous control monitoring and to satisfy regulator‑driven due‑diligence expectations.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2024‑35250 immediately across all Windows endpoints and servers.
- Verify patch rollout through automated configuration‑management tools and capture screenshots or logs as audit evidence.
- Enhance privileged‑account monitoring (e.g., anomalous SYSTEM‑level process creation) to detect any post‑patch exploitation attempts.
- Update your control‑mapping inventory to reflect the remediation of the “Access Control – Privilege Escalation” control.
- Document the remediation steps in your risk‑management system to provide a defensible audit trail.
Source: https://nvd.nist.gov/vuln/detail/CVE-2024-35250