--- title: Exploiting Microsoft Kernel Applocker Driver (CVE-2024-38041) description: In recent July Patch Tuesday Microsoft patched a vulnerability in the Microsoft Kernel driver appid.sys, which is the central driver behind AppLocker, the application whitelisting technology built into Windows. image: https://csacyber.com/hubfs/kernelapp.png --- [Skip to content](https://csacyber.com/blog/exploiting-microsoft-kernel-applocker-driver-cve-2024-38041#main-content) [![CSA Cyber - Cyber Security Solutions to Protect your People](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=300&height=108&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber - Cyber Security Solutions to Protect your People")](https://csacyber.com/) - Services - [Offensive Security Services](https://csacyber.com/offensive-security-services) - [Penetration Testing](https://csacyber.com/penetration-testing) - [Red Teaming and attack simulations](https://csacyber.com/offensive-security-services#red-teaming) - [Continuous testing](https://csacyber.com/offensive-security-services#continuous-assurance) - [Managed offensive security](https://csacyber.com/offensive-security-services#managed-offensive) - [Consultancy Services](https://csacyber.com/cyber-consultancy-services) - [Frameworks & assessments](https://csacyber.com/cyber-consultancy-services/frameworks-and-assessments) - [Data protection](https://csacyber.com/cyber-consultancy-services#data-protection) - [Virtual leadership](https://csacyber.com/cyber-consultancy-services#virtual-leadership) - [Technical security consulting](https://csacyber.com/cyber-consultancy-services#technical-consultancy) - [Governance, Risk & Compliance (GRC)](https://csacyber.com/cyber-consultancy-services/governance-risk-and-compliance-services) - [Extended Managed Security Services](https://csacyber.com/extended-managed-security-services) - [Microsoft Sentinel SIEM](https://csacyber.com/extended-managed-security-services#microsoft-sentinel) - [SOC services](https://csacyber.com/extended-managed-security-services#soc-services) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/extended-managed-security-services#cyber-helpdesk) - [Incident Response Services](https://csacyber.com/incident-response-services) - [Emergency Incident Response](https://csacyber.com/urgent/emergency-incident-response) - [Incident Response Retainer](https://csacyber.com/incident-response-services) - [Cyber Incident Readiness & Response Planning](https://csacyber.com/incident-response-services) - [Tabletop Exercises & Live-Range Engagements](https://csacyber.com/incident-response-services) - [Specialist Security Services](https://csacyber.com/specialist-services) - [AI Security](https://csacyber.com/cyber-services-for-ai) - [Operational Technology (OT)](https://csacyber.com/specialist-services#operational-technology) - [Cyber security for Private Equity](https://csacyber.com/specialist-services#mergers-and-acquisitions) - [Cyber training and education](https://csacyber.com/specialist-services#training-and-education) - [Virtual leadership](https://csacyber.com/specialist-services#leadership) - [Cyber Technologies](https://csacyber.com/cyber-technologies) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/cyber-technologies#sentinelone) - [AppGuard Endpoint & Server Zero Trust Protection](https://csacyber.com/cyber-technologies#appguard) - [Qualys Vulnerability Management as a Service (VMaaS)](https://csacyber.com/cyber-technologies#qualys-vmaas) - [Lookout Mobile Device Protection](https://csacyber.com/cyber-technologies#lookout) - [ThreatER DNS Protection](https://csacyber.com/cyber-technologies#threater-dns) - [Cyber Security Awareness & Training platform](https://csacyber.com/cyber-technologies#boxphish) - [About](https://csacyber.com/about-us) - [Careers](https://csacyber.com/careers) - [Certifications](https://csacyber.com/certifications-and-awards) - [Blog](https://csacyber.com/blog) - [Support Centre](https://csacyber.com/support) - Resources - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Partners](https://csacyber.com/partners) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) - [Contact](https://csacyber.com/contact-us) - Search Search Search September 16, 2024 6 min read time # Exploiting Microsoft Kernel Applocker Driver (CVE-2024-38041) ![Erwin Krazek](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) [Written by: Erwin Krazek -](https://csacyber.com/blog/author/erwin-krazek) [Penetration Testing](https://csacyber.com/blog/tag/penetration-testing) ![](https://csacyber.com/hubfs/kernelapp.png) ### Overview In recent July Patch Tuesday Microsoft patched a vulnerability in the Microsoft Kernel driver appid.sys, which is the central driver behind [AppLocker](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview), the application whitelisting technology built into Windows. The vulnerability, [CVE-2024-38041](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-38041), allows a local attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (KASLR) bypass which might become a requirement in future releases of windows. This blog post details my process of patch diffing in the Windows kernel, analysing N-day vulnerability, finding the bug, and building a working exploit. This post doesn’t require any specialized Windows kernel knowledge to follow along, though a basic understanding of [memory disclosure bugs](https://en.wikipedia.org/wiki/Memory_leak) and operating system concepts is helpful. I’ll also cover the basics of patch diffing. ### Basics of Patch Diffing Patch diffing is a common technique of comparing two binary builds of the same code – a known-vulnerable one and one containing a security fix. It is often used to determine the technical details behind ambiguously-worded bulletins, and to establish the root causes, attack vectors and potential variants of the vulnerabilities in question. The approach has attracted plenty of research and tooling development over the years, and has been shown to be useful for identifying so-called N-day bugs, which can be exploited against users who are slow to adopt latest security patches. Overall, the risk of post-patch vulnerability exploitation is inevitable for software which can be freely reverse-engineered, and is thus accepted as a natural part of the ecosystem. In a similar vein, binary diffing can be utilized to discover discrepancies between two or more versions of a single product, if they share the same core code and coexist on the market, but are serviced independently by the vendor. One example of such software is the Windows operating system. ### KASLR in Windows 11 24H2 In previous Windows versions defeating KASLR has been trivial due to a number of syscalls including kernel pointers in their output. In Windows 11 24H2 however, as documented by Yarden Shafir in a [blog post](https://windows-internals.com/kaslr-leaks-restriction/) analysing the change, these kernel address leaks are no longer available to unprivileged callers. In the absence of the classic KASLR bypasses, in order to determine the layout of the kernel an info leak or new technique is required. ### Patch Diff (Appid.sys) In order to identify the specific cause of the vulnerability, we’ll compare the patched binary to the pre-patch binary and try to extract the difference using a tool called [BinDiff](https://www.zynamics.com/bindiff.html). I had already saved both binary versions on my computer, as I like to keep track of Patch Tuesday updates. Additionally, I had written a simple Python script to dump all drivers before applying monthly patches, and then doing the dump of the patched binaries afterward. However, we can use [Winbindex](https://winbindex.m417z.com/) to obtain two versions of appid.sys: one right before the patch and one right after, both for the same version of Windows. ![](https://csa.limited/assets/img/appid1.png) Getting sequential versions of the binaries is important, as even using versions a few updates apart can introduce noise from differences that are not related to the patch, and cause you to waste time while doing your analysis. Winbindex has made patch analysis easier than ever, as you can obtain any Windows binary beginning from Windows 10. I loaded both of the files in [IDA Decompiler](https://hex-rays.com/) and ran the analysis. Afterward, the files can be exported into a BinExport format using the extension BinExport then being loaded into BinDiff tool. ![](https://csa.limited/assets/img/newdiff.png) Creating a new diff ![](https://csa.limited/assets/img/bindiffsummary.png) BinDiff summary comparing the pre and post-patch binaries BinDiff works by matching functions in the binaries being compared using various algorithms. In this case there, we have applied function symbol information from Microsoft, so all the functions can be matched by name. ![](https://csa.limited/assets/img/matchedfunctions.png) List of matched functions sorted by similarity Above we see there is only one function that have a similarity less than 100%. The function that was changed by the patch is AipDeviceIoControlDispatch. ![](https://csa.limited/assets/img/newchecks.png) New checks introduced In the above image we can see the two highlighted in red blocks that have been added in the patched version of the driver. This code checks the [PreviousMode](https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/previousmode) of the incoming IOCTL packet in order to verify that the packet is coming from a kernel-mode rather then user-mode. ### Root cause analysis The screenshots below shows the changed code pre and post-patch when looking at the decompiled function code of AipDeviceIoControlDispatch in IDA. ![](https://csa.limited/assets/img/prepatch.png) Pre-patch version of appid.sys Windows 11 22H2 ![](https://csa.limited/assets/img/postpatch.png) Post-patch version of appid.sys Windows 11 22H2 This change shown above is the only update to the identified function. Some quick analysis showed that a check is being performed based on PreviousMode. If PreviousMode is zero (indicating that the call originates from the kernel) pointers are written to the output buffer specified in the SystemBuffer field. If, on the other hand, PreviousMode is not zero and Feature\_2619781439... is enabled then the driver will simply return STATUS\_INVALID\_DEVICE\_REQUEST (0xC0000010) error code. ### Exploitation The first step is to communicate with the driver to trigger its vulnerability. To communicate with the driver, you typically need to find the Device Name, obtain a handle, and then send the appropriate [IOCTL](https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/introduction-to-i-o-control-codes) code to reach the vulnerability. For this purpose, the IoCreateDevice function was analyzed in the DriverEntry function and the third argument of DeviceName is found to be \\\\Device\\\\AppID. ![](https://csa.limited/assets/img/codesnipexploit.png) [Decoding](https://www.osronline.com/article.cfm%5earticle=229.htm) the 0x22A014 control code and extracting the RequiredAccess field reveals that a handle with write access is required to call it. Inspecting the device’s ACL (Access Control List; see the screenshot below), there are entries for local service, administrators, and appidsvc. While the entry for administrators does not grant write access, the entry for local service does. ![](https://csa.limited/assets/img/symlink.png) As the [local service](https://learn.microsoft.com/en-us/windows/win32/services/localservice-account) account has reduced privileges compared to administrators, this also gives the vulnerability a somewhat higher impact than standard admin-to-kernel. This might be the reason Microsoft characterized the CVE as Privileges Required: Low, taking into account that local service processes do not always necessarily have to run at higher integrity levels. Given the fact that I already have wrote an [exploit](https://github.com/Nero22k/Exploits/tree/main/Windows/CVE-2024-21338) for CVE-2024-21338 which is the same driver that we analyse so I will only provide the modified version of the code [here](https://github.com/Nero22k/Exploits/tree/main/Windows/CVE-2024-38041). ![](https://csa.limited/assets/img/sucess.png) Successful Exploitation ### Summary In this blog post we've covered patch diffing, root cause analysis and process of exploiting the vulnerability. It's important to monitor for new code additions as sometimes it can be fruitful for finding vulnerabilities. Despite best efforts by Microsoft trying to follow secure coding practices, there are always things that gets often overlooked during code reviews which create vulnerabilities that attackers often are trying to exploit. ### Bibliography [\[1\] – Diffing Binaries vs Anti-Diffing](https://www.blackhat.com/presentations/bh-usa-09/OH/BHUSA09-Oh-DiffingBinaries-SLIDES.pdf) [\[2\] – Do you even Diff?](https://www.cisoplatform.com/profiles/blogs/bruh-do-you-even-diff-diffing-microsoft-patches-to-find-vulnerabi) [\[3\] – KASLR Restrictions](https://windows-internals.com/kaslr-leaks-restriction/) [\[4\] – Using Binary Diffing To Discover](https://googleprojectzero.blogspot.com/2017/10/using-binary-diffing-to-discover.html) [\[5\] – Patch Tuesday Exploit Wednesday](https://securityintelligence.com/x-force/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock/) Related Posts ## You may also like this [Similar Articles](https://csacyber.com/blog) [![](https://csacyber.com/hs-fs/hubfs/20230510-N1005919-Edit1.jpg?width=624&height=427&name=20230510-N1005919-Edit1.jpg)](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) August 24, 2026 2 min read ### [FluidOne Group appoints Charly Davis as Managing Director of CSA Cyber to advance its security-first strategy](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) Experienced industry leader joins FluidOne to strengthen integrated cyber, IT and secure networking... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![](https://csacyber.com/hs-fs/hubfs/Untitled%20design.jpg?width=624&height=427&name=Untitled%20design.jpg)](https://csacyber.com/blog/csa-cyber-and-fluidone-named-as-suppliers-on-g-cloud-15) August 20, 2026 2 min read ### [CSA Cyber and FluidOne named as suppliers on G-Cloud 15](https://csacyber.com/blog/csa-cyber-and-fluidone-named-as-suppliers-on-g-cloud-15) CSA Cyber (CSA), part of the FluidOne Group, has been named as a supplier on Government Commercial... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![](https://csacyber.com/hs-fs/hubfs/Engineered%20to%20Endure%20Campaign%20Assets%20(2).png?width=624&height=427&name=Engineered%20to%20Endure%20Campaign%20Assets%20(2).png)](https://csacyber.com/blog/why-organisations-lose-security-visibility-without-realising-it) August 20, 2026 6 min read ### [Why organisations lose security visibility without realising it](https://csacyber.com/blog/why-organisations-lose-security-visibility-without-realising-it) Before an organisation can understand risk, maintain control or respond effectively to emerging... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![CSA Cyber Logo FNL_Full Logo](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=3463&height=1248&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber Logo FNL_Full Logo")](https://csacyber.com/) Established in 2013, Cyber Security Associates Limited trading as CSA Cyber provides cyber consultancy and cyber managed services which help to detect, protect and educate against the ever-changing cyber threat. We have built our team from a foundation of Government (ex-Military) and Commercially experienced specialists all holding current and relevant cyber certifications. Today our core services are based around a 24/7 Security Operations Centre (SOC) based in Gloucester. #### News & Resources - [Blog](https://csacyber.com/blog) - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Careers](https://csacyber.com/careers) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) #### Quick Links - [About Us](https://csacyber.com/about-us) - [Certifications](https://csacyber.com/certifications-and-awards) - [Our Parent Company](https://www.fluidone.com) - [Partners](https://csacyber.com/partners) - [Contact Us](https://csacyber.com/contact-us) - [Anti Bribery Policy](https://csacyber.com/hubfs/CSAAnti-BriberyPolicy.pdf) - [Complaints Policy](https://csacyber.com/hubfs/CSAComplaintsPolicy.pdf) - [Corporate Social Responsibility Policy](https://csacyber.com/hubfs/CSACorporateSocialResponsibilityPolicy.pdf) - [Slavery and Human Trafficking Statement](https://csacyber.com/hubfs/CSASlaveryandHumanTraffickingStatement.pdf) - [NCSC CHECK Status Verification](https://www.ncsc.gov.uk/organisation/csa-cyber/check-penetration-testing) - [CREST Approved Certification Verification](https://www.crest-approved.org/member_companies/csa-cyber/) #### Contact Information **United Kingdom - London** Cyber Security Associates Ltd 5 Hatfields, London, SE1 9PG   **United Kingdom - Gloucester** Cyber Security Associates Ltd Unit 11, Wheatstone Court, Waterwells Business Park, GL2 2AQ   **Phone:** [+44(0) 300 303 4691](tel:03003034691) **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   **United States of America** Cyber Security Associates Inc. 6010 W. Spring Creek Pkwy, Plano, Texas, 75024   **Phone:** [+1 469 750 1695](tel:14697501695)  **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   [![trust-pilot](https://csacyber.com/hs-fs/hubfs/trust-pilot.png?width=178&height=104&name=trust-pilot.png)](https://uk.trustpilot.com/review/csa.limited)   --- - [Website Terms of Use](https://csacyber.com/website-terms-of-use) - [Website Privacy Policy](https://csacyber.com/privacy-notice) - [Website Cookie Policy](https://csacyber.com/cookie-policy) Copyright 2026. Cyber Security Associates Ltd [Follow us on Facebook](https://www.facebook.com/CSALIMITED/) [Follow us on LinkedIn](https://www.linkedin.com/company/csa-cyber/) [Follow us on Twitter](https://twitter.com/cybersecurityis) [Follow us on Facebook](https://www.youtube.com/@cybersecurityassociateslim) [Follow us on Facebook](https://www.instagram.com/cybersecurityassociates) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Erwin Krazek", "url" : "https://csacyber.com/blog/author/erwin-krazek" }, "dateModified" : "2024-12-06T11:26:10.817Z", "datePublished" : "2024-09-16T04:15:00.000Z", "headline" : "Exploiting Microsoft Kernel Applocker Driver (CVE-2024-38041)", "image" : [ "https://csacyber.com/hubfs/kernelapp.png" ], "mainEntityOfPage" : { "@id" : "https://csacyber.com/blog/exploiting-microsoft-kernel-applocker-driver-cve-2024-38041", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://csacyber.com/hubfs/csacyber-logo-black-01.svg" }, "name" : "Cyber Security Associates Ltd" } } ```