CVE-2024-30072 Overview
CVE-2024-30072 is a remote code execution vulnerability in the Microsoft Windows Event Trace Log (ETL) file parsing component. The flaw is classified as an integer overflow or wraparound weakness [CWE-190] affecting Windows 11 and Windows Server 2022 systems. An attacker can craft a malicious ETL file that triggers memory corruption when parsed, leading to code execution in the context of the current user. Exploitation requires local access and user interaction, meaning the target must open or process the malicious file. Microsoft addressed this issue in the June 2024 Patch Tuesday release.
Critical Impact
Successful exploitation grants attackers arbitrary code execution with the privileges of the user who processes the malicious ETL file, compromising confidentiality, integrity, and availability.
Affected Products
- Microsoft Windows 11 version 22H2
- Microsoft Windows 11 version 23H2
- Microsoft Windows Server 2022 version 23H2
Discovery Timeline
- 2024-06-11 - CVE-2024-30072 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2024-30072
Vulnerability Analysis
The vulnerability resides in the Windows subsystem responsible for parsing Event Trace Log (.etl) files. ETL files store binary event data generated by Event Tracing for Windows (ETW), a kernel-level tracing facility used for diagnostics and performance analysis. The parser handles size and length fields from untrusted file structures without adequate validation.
An attacker crafts an ETL file with manipulated length or count fields that trigger an integer overflow during size calculations. The overflow causes downstream allocations or memory operations to use undersized buffers. Subsequent write operations exceed those buffers, corrupting adjacent memory and enabling arbitrary code execution.
Exploitation requires the target to open the malicious ETL file, typically through a diagnostic tool, log viewer, or automated processing pipeline. Code executes with the privileges of the user account running the parser.
Root Cause
The root cause is an integer overflow condition [CWE-190] in ETL file parsing logic. Arithmetic operations on attacker-controlled length or count fields wrap around, producing incorrect buffer size values. The parser then trusts these values for memory allocation and copy operations, resulting in a heap corruption primitive.
Attack Vector
The attack vector is local and requires user interaction. An attacker delivers a crafted ETL file through phishing, file share, USB media, or a supply chain vector. When the victim opens or processes the file with a vulnerable Windows component, the parser triggers the overflow and executes attacker-controlled code. The vulnerability does not require prior authentication, but it does depend on user action.
No verified public proof-of-concept code is available. Refer to the Microsoft CVE-2024-30072 Update Guide for vendor technical details.
Detection Methods for CVE-2024-30072
Indicators of Compromise
- Unexpected .etl files delivered through email attachments, downloads, or removable media from untrusted sources.
- Crash or unexpected termination of processes that consume ETL data such as tracerpt.exe, logman.exe, or Event Viewer.
- Child process creation from log-parsing utilities that spawn shells, PowerShell, or rundll32.exe.
- Anomalous file writes or persistence changes following interaction with an ETL file.
Detection Strategies
- Monitor process execution chains where ETL parsing utilities launch scripting hosts or unsigned binaries.
- Alert on ETL files opened from user download or temporary directories, particularly outside standard diagnostic workflows.
- Correlate application crash telemetry (Windows Error Reporting) referencing ETL parser modules with subsequent suspicious activity.
Monitoring Recommendations
- Enable Sysmon Event ID 1 (process creation) and Event ID 11 (file create) to track ETL file handling.
- Ingest Windows Defender exploit guard and application crash logs into a centralized SIEM for correlation.
- Baseline legitimate ETL processing workflows so anomalous parsing on user endpoints becomes visible.
How to Mitigate CVE-2024-30072
Immediate Actions Required
- Apply the June 2024 Microsoft security updates to all Windows 11 22H2, 23H2, and Windows Server 2022 23H2 systems.
- Prioritize patching endpoints used by administrators, developers, and support staff who routinely process ETL files.
- Block inbound .etl file attachments at email gateways and web proxies until patching is verified.
- Educate users to avoid opening ETL files from untrusted sources.
Patch Information
Microsoft released a security update on June 11, 2024, addressing CVE-2024-30072. Full remediation details and download links are available in the Microsoft CVE-2024-30072 Update Guide. Deploy the applicable cumulative update via Windows Update, WSUS, Microsoft Update Catalog, or your endpoint management platform.
Workarounds
- Restrict ETL file handling to trusted administrative workflows using application control policies such as Windows Defender Application Control or AppLocker.
- Disassociate the .etl file extension from parsing utilities on standard user workstations that do not require diagnostic tooling.
- Enforce least privilege so users processing log files operate without administrative rights, limiting the impact of successful exploitation.
# Configuration example: verify installed Windows update level
wmic qfe list brief /format:table
Get-HotFix | Sort-Object -Property InstalledOn -Descending
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
