CVE-2024-30072: Windows 11 22h2 Event Trace RCE Flaw

CVE-2024-30072 Overview

CVE-2024-30072 is a remote code execution vulnerability in the Microsoft Windows Event Trace Log (ETL) file parser. The flaw is classified as an integer overflow [CWE-190] and affects Windows 11 and Windows Server 2022 systems. An attacker who convinces a local user to open a crafted ETL file can trigger arithmetic overflow during parsing and execute code in the context of the current user. The issue carries a CVSS 3.1 base score of 7.8 and requires user interaction. Microsoft addressed the vulnerability in the June 2024 security update cycle.

Critical Impact
Successful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the user opening the malicious .etl file, compromising confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Windows 11 22H2
Microsoft Windows 11 23H2
Microsoft Windows Server 2022 23H2

Discovery Timeline

2024-06-11 - CVE-2024-30072 published to NVD alongside Microsoft's June 2024 Patch Tuesday release
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2024-30072

Vulnerability Analysis

The vulnerability resides in the Windows component responsible for parsing Event Trace Log (ETL) files. ETL files store binary trace data generated by Event Tracing for Windows (ETW) and are consumed by tools such as tracerpt.exe, logman.exe, and various Performance Analyzer utilities. During parsing, the affected code performs arithmetic on attacker-controlled size or count fields without adequate bounds validation. The resulting integer overflow produces an undersized allocation that is subsequently written past its intended bounds, corrupting adjacent memory and enabling control of execution flow.

Exploitation requires the target user to open a malicious ETL file. Because ETL files are commonly shared for troubleshooting and diagnostic purposes, an attacker can plausibly deliver the file through email, chat, or a shared network location. Once executed, code runs under the invoked process token, providing a foothold that can be paired with a separate privilege escalation for full system compromise.

Root Cause

The root cause is an integer overflow [CWE-190] in the ETL parsing routine. Untrusted length or record-count fields inside the ETL container are used in size calculations without checks for wraparound, leading to a heap allocation smaller than the data that will be copied into it. The subsequent out-of-bounds write corrupts heap metadata or adjacent objects and enables arbitrary code execution.

Attack Vector

The attack vector is local with required user interaction. An attacker crafts a malicious .etl file, delivers it to a target, and induces the user to open it with a trace-viewing utility or an application that automatically parses ETL content. No network exposure or elevated privileges are required prior to exploitation. Full technical details are not publicly disclosed; refer to the Microsoft Security Update Guide for CVE-2024-30072 for vendor-authoritative information.

Detection Methods for CVE-2024-30072

Indicators of Compromise

Unexpected .etl files arriving via email attachments, chat platforms, or downloads from untrusted sources.
Crashes or abnormal terminations of tracerpt.exe, logman.exe, perfmon.exe, or other ETW consumer processes shortly after opening a trace file.
Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned from ETL-consuming utilities.
Suspicious outbound network connections initiated by trace-viewing processes following ETL file access.

Detection Strategies

Monitor process creation events for ETW-related binaries launching interactive shells or script interpreters.
Alert on write operations that place .etl files in user-writable locations followed by immediate user interaction.
Correlate Windows Error Reporting events (Event ID 1000/1001) referencing ETL parsing modules with subsequent anomalous activity.

Monitoring Recommendations

Track file downloads and email attachments with the .etl extension across mail gateways and web proxies.
Ingest endpoint process telemetry into a centralized data lake to enable cross-host hunting for the behaviors described above.
Review patch compliance dashboards to confirm the June 2024 Windows cumulative updates are installed on all Windows 11 and Server 2022 hosts.

How to Mitigate CVE-2024-30072

Immediate Actions Required

Apply the Microsoft June 2024 cumulative security update to all affected Windows 11 22H2, Windows 11 23H2, and Windows Server 2022 23H2 systems.
Inventory endpoints that have not yet received the update and prioritize them based on user exposure to external file sharing.
Educate users to avoid opening .etl files received from untrusted or unexpected sources.

Patch Information

Microsoft released a fix for CVE-2024-30072 as part of the June 11, 2024 security update. Refer to the Microsoft Security Update Guide entry for CVE-2024-30072 for the applicable KB article and package downloads per affected Windows build.

Workarounds

Restrict which applications are registered to open .etl files by removing or hardening the file-type association for standard users.
Block inbound .etl attachments at the email gateway and web proxy where operationally feasible.
Enforce least-privilege user accounts so that code executed via a malicious ETL file runs without administrative rights.

bash

# Configuration example: verify the June 2024 update is installed on a Windows host
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2024-06-11') } | Sort-Object InstalledOn