CVE-2024-54131 Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3)
Local attackers can escalate privileges to SYSTEM on Windows by placing a malicious DLL in the agent's search path due to insecure default permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-54131?
CVE-2024-54131 is a high-severity vulnerability in kolide launcher, published on 3 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Kolide Agent (aka: Launcher) is the lightweight agent designed to work with Kolide's service. An implementation bug in the Kolide Agent (known as `launcher`) allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. The bug was introduced in version 1.5.3 when launcher started storing upgraded binaries in the ProgramData directory. This move to the new directory meant the launcher root directory inherited default permissions that are not as strict as the previous location. These incorrect default permissions in conjunction with an omitted SystemDrive environmental variable (when launcher starts osqueryd), allows a malicious actor with access to the local Windows device to successfully place an arbitrary DLL into the osqueryd process's search path. Under some circumstances, this DLL will be executed when osqueryd performs a WMI query. This combination of events could then allow the attacker to escalate their privileges to SYSTEM. Impacted versions include versions >= 1.5.3 and the fix has been released in 1.12.3.
Which versions are affected by CVE-2024-54131?
3 open source packages ship an affected version, including github.com/kolide/launcher.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kolide/launcher Go | From 1.5.3 | 1.12.3 |
github.com/kolide/launcher Go | From 1.5.3 | 1.12.3 |
github.com/kolide/launcher Go | From 1.5.3 | 1.12.3 |
How do I fix CVE-2024-54131?
Upgrade github.com/kolide/launcher to 1.12.3 or later.
Is CVE-2024-54131 being exploited?
There is no known exploitation of CVE-2024-54131 in the wild and no public exploit code.
Sources
Also known as GHSA-66q9-2rvx-qfj5, GO-2024-3308.