CVE-2024-35250
HIGH KEVWindows Kernel-Mode Driver - Privilege Escalation
Title source: llmExploitation Summary
CVE-2024-35250 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 16, 2024.
EIP tracks 7 public exploits from researchers including yinsel, ro0tmylove, CrackerCat, including a Metasploit module exploits/windows/local/cve_2024_35250_ks_driver.
AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2024-35250, leveraging an untrusted pointer dereference (CWE-822) to achieve arbitrary read/write operations in kernel memory. The code includes helper functions for kernel object pointer retrieval, bitmap allocation, and process creation from a handle, targeting Windows 10/11 environments.
Description
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Exploits (7)
This repository contains a functional exploit PoC for CVE-2024-35250, leveraging an untrusted pointer dereference (CWE-822) to achieve arbitrary read/write operations in kernel memory. The code includes helper functions for kernel object pointer retrieval, bitmap allocation, and process creation from a handle, targeting Windows 10/11 environments.
This repository contains a functional exploit PoC for CVE-2024-35250, leveraging an untrusted pointer dereference (CWE-822) in Windows kernel-mode drivers. The exploit includes arbitrary read/write primitives, kernel object pointer leakage, and process creation via handle manipulation, targeting Windows 10/11 and VMWare Workstation 17 Pro.
This repository contains a functional exploit PoC for CVE-2024-35250, targeting an untrusted pointer dereference vulnerability (CWE-822) in Windows systems. The code demonstrates arbitrary read/write operations and process creation via handle manipulation, with specific targeting for Windows 11/10 and VMWare environments.
The repository contains a functional proof-of-concept exploit for CVE-2024-35250, targeting a Windows kernel vulnerability. The exploit leverages kernel object manipulation and arbitrary function calls to achieve local privilege escalation (LPE) by modifying token privileges or previous mode settings.
This repository contains a functional exploit for CVE-2024-35250, a local privilege escalation vulnerability in the Windows Kernel Streaming driver (ks.sys) due to an untrusted pointer dereference. The exploit bypasses HVCI by manipulating kernel data structures to achieve arbitrary read/write and token swapping.
This Metasploit module exploits a local privilege escalation vulnerability in the Windows ks.sys driver due to an access mode mismatch. It targets Windows 10, 11, and Server 2016-2022 by injecting a malicious DLL into a notepad process to achieve SYSTEM privileges.
This repository contains functional exploit code for CVE-2024-35250, demonstrating a kernel-level vulnerability in Windows. The PoC leverages kernel handle manipulation and memory corruption to achieve privilege escalation.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H