CVE-2024-30062 Overview
CVE-2024-30062 is a remote code execution vulnerability in the Windows Standards-Based Storage Management Service. The flaw is classified as a Use After Free issue [CWE-416] affecting multiple supported versions of Windows Server. Microsoft published the advisory on June 11, 2024.
Exploitation requires local access and user interaction. A successful attack allows an adversary to execute code with high impact to confidentiality, integrity, and availability on the affected host. Microsoft has released updates that address the vulnerability through the standard security update channel.
Critical Impact
Successful exploitation grants attackers arbitrary code execution on affected Windows Server hosts, enabling full compromise of confidentiality, integrity, and availability.
Affected Products
- Microsoft Windows Server 2012 R2
- Microsoft Windows Server 2016
- Microsoft Windows Server 2019
- Microsoft Windows Server 2022
Discovery Timeline
- 2024-06-11 - CVE-2024-30062 published to NVD
- 2024-06-11 - Microsoft released security update for CVE-2024-30062
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2024-30062
Vulnerability Analysis
The vulnerability resides in the Windows Standards-Based Storage Management Service, a component that provides a standards-compliant interface for managing storage devices on Windows Server. It is categorized as a Use After Free condition [CWE-416], in which the service references memory that has already been released.
When the freed memory region is reallocated with attacker-controlled data, the dangling reference can be leveraged to redirect execution flow. This yields arbitrary code execution in the context of the vulnerable service. The attack requires local access and a user interaction step to trigger the vulnerable code path.
The EPSS score of approximately 1.005% places this issue in the 60th percentile for exploitation likelihood based on current telemetry.
Root Cause
The root cause is improper object lifetime management inside the storage management service. A code path releases a memory object while another reference to that object remains active. Subsequent operations dereference the stale pointer, resulting in memory corruption and control-flow hijacking opportunities for an attacker.
Attack Vector
An authenticated local attacker triggers the vulnerable code path through crafted interactions with the storage management service. User interaction is required, which typically means an administrator or operator must invoke a specific storage management action. Once triggered, the use-after-free condition allows the attacker to execute code within the service context.
No public proof-of-concept exploit is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Consult the Microsoft Security Update for CVE-2024-30062 for authoritative technical details.
Detection Methods for CVE-2024-30062
Indicators of Compromise
- Unexpected crashes or restarts of the Windows Standards-Based Storage Management Service (smphost).
- Abnormal child processes spawned by the storage management service or associated svchost instance.
- Event log entries showing access violations or heap corruption inside the storage management service process.
Detection Strategies
- Monitor endpoint telemetry for anomalous process creation and memory operations linked to the storage management service.
- Correlate service crash events with subsequent execution of unusual binaries or scripts on the same host.
- Track invocation of storage management APIs and WMI storage providers by non-administrative users.
Monitoring Recommendations
- Enable Windows Event Log forwarding for System and Application logs from all Windows Server hosts.
- Alert on Service Control Manager events indicating repeated failures of the storage management service.
- Baseline normal storage management activity per host and flag deviations for review.
How to Mitigate CVE-2024-30062
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2024-30062 to all affected Windows Server hosts.
- Prioritize patching on servers where the storage management service is actively used or exposed to standard users.
- Verify patch deployment through configuration management tooling and confirm the corresponding KB is present.
Patch Information
Microsoft published fixes for Windows Server 2012 R2, 2016, 2019, and 2022 as part of the June 2024 security update cycle. Administrators should consult the Microsoft Security Update for CVE-2024-30062 to identify the exact KB article for each affected build and confirm installation status.
Workarounds
- Restrict local logon rights on servers running the storage management service to essential administrators only.
- Disable the Windows Standards-Based Storage Management Service on hosts that do not require standards-based storage provider functionality.
- Enforce least privilege for operators interacting with storage management tooling to reduce user-interaction attack surface.
# Query and stop the storage management service on hosts where it is not required
Get-Service -Name smphost
Stop-Service -Name smphost -Force
Set-Service -Name smphost -StartupType Disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
