CVE-2024-29995 Overview
CVE-2024-29995 is an elevation of privilege vulnerability in Microsoft Windows Kerberos authentication. The flaw allows an unauthenticated network attacker to gain elevated privileges on affected systems through observable discrepancies in the Kerberos protocol implementation [CWE-208]. The vulnerability impacts Windows client and server editions ranging from Windows 10 through Windows 11, and Windows Server 2008 through Windows Server 2022. Microsoft published the advisory on August 13, 2024, addressing the issue across the supported Windows ecosystem.
Critical Impact
A successful attacker can elevate privileges over the network to compromise confidentiality, integrity, and availability of Kerberos-authenticated Windows systems.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2) and Windows 11 (21H2, 22H2)
- Microsoft Windows Server 2008, 2008 R2, 2012, and 2012 R2
- Microsoft Windows Server 2016, 2019, and 2022
Discovery Timeline
- 2024-08-13 - CVE-2024-29995 published to NVD
- 2024-08-16 - Last updated in NVD database
Technical Details for CVE-2024-29995
Vulnerability Analysis
The vulnerability resides in the Windows Kerberos authentication subsystem. Kerberos is the default authentication protocol for Active Directory domain environments. The flaw is categorized under [CWE-208] (Observable Timing Discrepancy), indicating that an attacker can infer sensitive information or authentication state from variations in the protocol's response behavior.
An unauthenticated attacker on the network can exploit this side-channel weakness to gain elevated privileges within a Windows domain. Successful exploitation impacts confidentiality, integrity, and availability of the target system. While attack complexity is high — requiring specific conditions for reliable observation of the timing discrepancies — no privileges or user interaction are required.
The EPSS probability for this CVE is 6.141%, placing it in the 90.99th percentile relative to other published vulnerabilities.
Root Cause
The root cause is an observable discrepancy in the Kerberos protocol implementation. Differences in processing time or response content allow an attacker to deduce secret state related to authentication. Microsoft has not released detailed internal technical specifics beyond the advisory entry.
Attack Vector
The attack vector is network-based. The attacker sends crafted Kerberos messages to a vulnerable Windows host and observes the resulting protocol responses. By repeating the process, the attacker collects enough information to derive material that enables privilege elevation within the Kerberos realm. No prior authentication or user interaction is required, though successful execution depends on conditions outside the attacker's direct control.
No public proof-of-concept exploit code is available for CVE-2024-29995. Refer to the Microsoft CVE-2024-29995 Advisory for vendor-supplied technical details.
Detection Methods for CVE-2024-29995
Indicators of Compromise
- Unusual volumes of Kerberos Authentication Service (AS-REQ) or Ticket Granting Service (TGS-REQ) traffic from a single source to a domain controller
- Repeated Kerberos pre-authentication failures (Event ID 4771) followed by successful authentications from the same principal
- Unexpected Ticket Granting Tickets (TGTs) issued to accounts that have not interactively logged on
- Anomalous logon events (Event ID 4624) using Kerberos with privileged accounts originating from unusual workstations
Detection Strategies
- Monitor Windows Security Event logs on domain controllers for Kerberos events 4768, 4769, 4770, and 4771 and correlate spikes across short time windows
- Detect lateral movement patterns where service tickets are requested for high-value services such as cifs, host, or ldap shortly after anomalous AS-REQ activity
- Baseline Kerberos response timing against historical norms to surface protocol-level probing consistent with timing side-channel exploitation
Monitoring Recommendations
- Forward domain controller security logs to a centralized SIEM and enable retention sufficient for retrospective analysis
- Enable Kerberos protocol logging on domain controllers and ingest the data into security analytics platforms
- Continuously inventory unpatched Windows hosts using vulnerability management tooling tied to the August 2024 Patch Tuesday baseline
How to Mitigate CVE-2024-29995
Immediate Actions Required
- Apply the August 2024 Microsoft security updates to all affected Windows client and server systems
- Prioritize patching of Active Directory domain controllers and identity infrastructure first
- Audit privileged account activity for evidence of anomalous Kerberos ticket requests during the exposure window
- Restrict network access to Kerberos services (TCP/UDP 88) from untrusted network segments
Patch Information
Microsoft released fixes as part of the August 2024 Patch Tuesday cycle. Administrators should consult the Microsoft CVE-2024-29995 Advisory for the specific KB numbers and cumulative updates applicable to each Windows version.
Workarounds
- No vendor-supplied workarounds are listed; applying the security update is the supported remediation path
- Segment domain controllers and tier-0 assets behind firewalls that restrict Kerberos traffic to known administrative hosts
- Enforce strong authentication policies and disable legacy protocols that may compound the impact of Kerberos abuse
# Verify installation of the August 2024 cumulative update on Windows
wmic qfe list brief /format:table
# PowerShell equivalent
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
