CVE-2024-23940 Overview
CVE-2024-23940 affects Trend Micro uiAirSupport, a component bundled with the Trend Micro Security 2023 family of consumer products. Versions 6.0.2092 and below contain a DLL hijacking and proxying weakness classified as [CWE-427] Uncontrolled Search Path Element. An attacker with local access can plant a malicious library that the trusted uiAirSupport process loads, executing attacker-controlled code inside a privileged security product. Successful exploitation leads to code execution and privilege escalation on the affected Windows host.
Critical Impact
A local attacker can hijack a DLL loaded by Trend Micro uiAirSupport to execute arbitrary code and escalate privileges on the endpoint.
Affected Products
- Trend Micro uiAirSupport (Air Support) version 6.0.2092 and below
- Trend Micro Antivirus+ Security, Internet Security, Maximum Security, and Premium Security (2023 family)
- Microsoft Windows hosts running the affected Trend Micro Security 2023 products
Discovery Timeline
- 2024-01-29 - CVE-2024-23940 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23940
Vulnerability Analysis
The uiAirSupport component ships as part of Trend Micro's consumer security suite and runs with elevated rights on Windows. The binary loads one or more supporting libraries using an insecure search order, allowing an attacker-supplied DLL placed in a writable directory to be loaded in place of the legitimate module. Because the attacker DLL executes inside the trusted Trend Micro process, it inherits the process token and any privileges the security product holds. This turns a defensive tool into an execution vector, a pattern documented in the Medium analysis of AV DLL abuse. Local user interaction is required, so exploitation typically occurs through a lure such as launching a document, installer, or shortcut staged next to the malicious library.
Root Cause
The root cause is an uncontrolled DLL search path in uiAirSupport. The application resolves dependent libraries without pinning them to a signed, fully qualified path, so Windows can load a same-named DLL from a directory that a standard user controls. DLL proxying further allows the attacker's library to forward legitimate exports to the real DLL, keeping the host application functional and the compromise stealthy.
Attack Vector
Exploitation is local and requires user interaction. An attacker drops a crafted DLL matching the name expected by uiAirSupport into a directory searched before the legitimate module location. When a user launches uiAirSupport or a bundled workflow triggers its execution, the loader binds to the malicious DLL. The payload then runs in the security product's process context and can create services, modify registry entries, or spawn additional processes to complete privilege escalation.
No verified public proof-of-concept code has been published for this CVE. Technical details on the class of attack are described in the Trend Micro advisory TMKA-12134.
Detection Methods for CVE-2024-23940
Indicators of Compromise
- Unsigned or unexpected DLLs residing in the uiAirSupport installation directory or user-writable paths adjacent to the executable
- uiAirSupport processes loading modules from paths outside the standard Program Files\Trend Micro tree
- Child processes spawned by uiAirSupport that are inconsistent with normal product behavior, such as cmd.exe, powershell.exe, or rundll32.exe
Detection Strategies
- Hunt for image loads by the uiAirSupport binary where the module path is not under the signed Trend Micro install directory
- Alert on file writes of DLLs into directories that appear in the uiAirSupport search path by non-installer processes
- Correlate module load events with parent process integrity level to detect unexpected privilege changes following a load
Monitoring Recommendations
- Enable Windows Sysmon Event ID 7 (Image Loaded) with filtering focused on Trend Micro processes
- Baseline the expected set of DLLs loaded by uiAirSupport and flag deviations for review
- Forward endpoint telemetry to a centralized analytics platform to correlate DLL side-loading behavior across the fleet
How to Mitigate CVE-2024-23940
Immediate Actions Required
- Update Trend Micro Security 2023 products to a version above uiAirSupport 6.0.2092 as directed in the vendor advisories
- Restrict standard user write access to directories included in the uiAirSupport DLL search path
- Audit endpoints for unsigned DLLs residing near the uiAirSupport executable and remove any that are not legitimate
Patch Information
Trend Micro published fixed builds and remediation guidance in advisories TMKA-12134 and TMKA-12132. Apply the updated uiAirSupport component through the Trend Micro update channel on all affected consumer endpoints.
Workarounds
- Disable or uninstall the uiAirSupport component until the patched version is deployed if immediate updates are not possible
- Enforce Windows AppLocker or Windows Defender Application Control rules that block unsigned DLL loads by security product processes
- Apply least-privilege permissions to any directory the uiAirSupport process searches during module resolution
# Example AppLocker DLL rule to block unsigned modules loaded by uiAirSupport
# Publisher condition allows only Trend Micro signed DLLs in the install path
# Path condition denies DLL execution from user-writable directories
New-AppLockerPolicy -RuleType Publisher,Path -User Everyone -FileInformation (Get-AppLockerFileInformation -Directory "C:\Program Files\Trend Micro\uiAirSupport" -Recurse -FileType Dll) -Optimize | Set-AppLockerPolicy -Merge
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
