CVE-2024-38107 Overview
CVE-2024-38107 is an elevation of privilege vulnerability in the Windows Power Dependency Coordinator (pdc.sys) kernel component. The flaw is a use-after-free condition [CWE-416] that allows a local, authenticated attacker to elevate privileges to SYSTEM. Microsoft disclosed the vulnerability as part of the August 2024 Patch Tuesday release, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog after confirming in-the-wild exploitation. The vulnerability affects a broad range of Windows client and server editions, including Windows 10, Windows 11, and Windows Server 2012 through Windows Server 2022 23H2.
Critical Impact
Successful exploitation grants SYSTEM-level privileges on the local host, enabling full compromise of the operating system, credential theft, and persistence. Active exploitation has been confirmed by CISA KEV.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (21H2, 22H2, 23H2, 24H2)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-08-13 - CVE-2024-38107 published to NVD as part of Microsoft's August 2024 Patch Tuesday
- 2025-10-28 - Last updated in NVD database
Technical Details for CVE-2024-38107
Vulnerability Analysis
The Windows Power Dependency Coordinator is a kernel-mode component that arbitrates power state dependencies between system devices and drivers. CVE-2024-38107 is classified as a use-after-free [CWE-416], where the component continues to reference a kernel object after the underlying memory has been freed. An attacker who has already obtained code execution as a standard user can trigger the dangling reference and reclaim the freed allocation with controlled data. This produces a write or call primitive in kernel context, leading to SYSTEM-level code execution.
Root Cause
The root cause is improper object lifetime management within the Power Dependency Coordinator. When a power-related request is processed, an internal object can be freed while another code path still holds a reference to it. Subsequent use of that stale pointer dereferences memory that an attacker can groom with crafted allocations from user mode.
Attack Vector
Exploitation requires local access and low privileges, with no user interaction. An attacker delivers initial access through phishing, a malicious document, or a compromised application. The unprivileged process then issues a sequence of system calls or device I/O requests that drive the Power Dependency Coordinator into the vulnerable state. Once kernel execution is achieved, the attacker disables security products, dumps LSASS, or installs a rootkit. Because the bug lives in pdc.sys, exploitation does not depend on a specific user-facing feature and is broadly reachable from any session.
No public proof-of-concept code has been published. Refer to the Microsoft Security Update Guide for vendor technical details.
Detection Methods for CVE-2024-38107
Indicators of Compromise
- Unexpected child processes (for example cmd.exe, powershell.exe, or rundll32.exe) spawning under SYSTEM from a non-service parent that was previously running as a standard user.
- New service or scheduled task creation immediately after a brief crash or unusual behavior of pdc.sys-related components.
- Kernel bug checks or Event ID 41 power-related events correlated in time with suspicious user-mode binaries executing from temp or user-writable paths.
Detection Strategies
- Hunt for token impersonation patterns where a user-context process suddenly accesses SYSTEM-owned handles, registry hives, or LSASS memory.
- Monitor abnormal NtPowerInformation and related power management syscall sequences originating from non-system binaries.
- Alert on unsigned or recently dropped binaries that load drivers, modify boot configuration, or open \\Device\\PhysicalMemory.
Monitoring Recommendations
- Enable kernel-mode telemetry and Microsoft-Windows-Kernel-Power event channel logging, and forward events to a SIEM for correlation.
- Track local privilege escalation chains by joining Sysmon process creation, parent integrity level, and token elevation events.
- Review CISA KEV-listed CVE patch compliance across Windows endpoints on a recurring schedule to ensure August 2024 updates are deployed.
How to Mitigate CVE-2024-38107
Immediate Actions Required
- Apply Microsoft's August 2024 security updates for all affected Windows 10, Windows 11, and Windows Server SKUs without delay.
- Prioritize patching for systems exposed to phishing, lateral movement, or where unprivileged users execute untrusted code.
- Audit endpoints against the CISA KEV remediation deadline and confirm pdc.sys reflects the patched version.
Patch Information
Microsoft released fixed builds on August 13, 2024. Refer to the Microsoft Security Update Guide for CVE-2024-38107 for the specific KB articles mapped to each affected Windows version. Validate installation by checking the file version of pdc.sys against the version listed in the corresponding KB.
Workarounds
- No official workaround is provided by Microsoft. Patching is the only supported remediation.
- Reduce risk in the interim by enforcing least-privilege user accounts and blocking execution of untrusted binaries via AppLocker or Windows Defender Application Control.
- Restrict local logon rights and remove unnecessary interactive sessions on servers to limit attacker access to a vulnerable local code path.
# Verify patch status via PowerShell - confirm pdc.sys version matches the KB-listed build
Get-Item C:\Windows\System32\drivers\pdc.sys | Select-Object Name, VersionInfo
# List installed August 2024 security updates
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2024-08-13') } | Sort-Object InstalledOn
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
