CVE-2024-21433: Windows 10 1507 Privilege Escalation Flaw

CVE-2024-21433 Overview

CVE-2024-21433 is an elevation of privilege vulnerability in the Windows Print Spooler service. The flaw stems from a race condition [CWE-367: Time-of-Check Time-of-Use (TOCTOU)] in how the Print Spooler validates and uses resources during privileged operations. A local, authenticated attacker who successfully exploits the race window can elevate privileges to SYSTEM on the affected host.

Microsoft published the advisory on March 12, 2024, covering supported Windows 10, Windows 11, and Windows Server releases. Exploitation requires local access and high attack complexity because the attacker must reliably win the race condition.

Critical Impact
Successful exploitation grants SYSTEM-level privileges on the local host, allowing full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and Server 2022 23H2

Discovery Timeline

2024-03-12 - CVE-2024-21433 published to NVD
2024-03-12 - Microsoft releases security patch via Patch Tuesday
2024-11-29 - Last updated in NVD database

Technical Details for CVE-2024-21433

Vulnerability Analysis

The Print Spooler service (spoolsv.exe) runs as SYSTEM and handles print job submission, queue management, and driver loading on Windows hosts. CVE-2024-21433 is a race condition in this service where a resource is checked in one state and then used after that state can be modified by another thread or process.

An authenticated local attacker who synchronizes operations against the spooler can substitute a controlled resource between the check and the use. The spooler then performs a privileged action on attacker-controlled input, producing arbitrary code execution in the SYSTEM context. The CWE-367 classification confirms the TOCTOU class of defect.

With an EPSS probability of 0.734% (72.9th percentile), the vulnerability is more likely than average to see exploitation attempts compared with the broader CVE population, though it is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is a TOCTOU defect in Print Spooler privileged operations. The service validates a property of a resource — such as a file path, handle, or object — and then operates on that resource without re-validation. An attacker racing the validation logic can swap the resource between the validation and the privileged use.

Attack Vector

The attack vector is local. An attacker must already have low-privilege code execution on the target host, typically through prior phishing, credential theft, or initial access via another vulnerability. The attacker then triggers spooler operations while concurrently modifying the targeted resource to win the race.

No public proof-of-concept code or in-the-wild exploitation has been reported for CVE-2024-21433. Microsoft has not released technical exploitation details. See the Microsoft CVE-2024-21433 Advisory for vendor guidance.

Detection Methods for CVE-2024-21433

Indicators of Compromise

Unexpected child processes spawned by spoolsv.exe, particularly cmd.exe, powershell.exe, or scripting hosts running as SYSTEM.
New or modified files written under %SystemRoot%\System32\spool\drivers\ or %SystemRoot%\System32\spool\PRINTERS\ by non-administrative users.
Registry changes under HKLM\SYSTEM\CurrentControlSet\Control\Print not originating from administrative installers or Windows Update.

Detection Strategies

Hunt for process lineage where spoolsv.exe is the parent of interactive or scripting binaries executing as SYSTEM.
Correlate rapid, repeated print API calls from a single low-privilege user with concurrent file or symlink operations against spooler-controlled paths, a pattern consistent with TOCTOU exploitation.
Alert on loading of unsigned or user-writable DLLs into spoolsv.exe.

Monitoring Recommendations

Enable Windows Security event logging for process creation (Event ID 4688) with command-line auditing, and ship logs to a centralized SIEM for correlation.
Monitor Print Service operational and admin logs (Microsoft-Windows-PrintService/Operational) for anomalous driver installs and printer additions from non-admin accounts.
Track file creation and rename events under spooler directories with EDR file telemetry to identify symlink and junction-based race attempts.

How to Mitigate CVE-2024-21433

Immediate Actions Required

Apply the March 2024 Microsoft security updates to all supported Windows 10, Windows 11, and Windows Server systems referenced in the advisory.
Inventory all Windows hosts running the Print Spooler service and prioritize patching on multi-user systems, terminal servers, and domain controllers.
Restrict local logon rights and remove unnecessary interactive users from systems that handle print workloads.

Patch Information

Microsoft addressed CVE-2024-21433 in the March 12, 2024 security updates. Patches are delivered through Windows Update and the Microsoft Update Catalog for all listed Windows 10, Windows 11, and Windows Server SKUs. Refer to the Microsoft CVE-2024-21433 Advisory for the specific KB numbers applicable to each Windows build.

Workarounds

Disable the Print Spooler service on servers and endpoints that do not require printing, particularly domain controllers and infrastructure hosts.
Use Group Policy to restrict which users can install printer drivers via Computer Configuration\Administrative Templates\Printers\Point and Print Restrictions.
Limit non-administrative users from creating symbolic links by auditing the SeCreateSymbolicLinkPrivilege assignment.

bash

# Disable and stop the Print Spooler service on hosts that do not need printing
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

# Verify status
Get-Service -Name Spooler