Pierluigi Paganini February 29, 2024

North Korea-linked Lazarus APT exploited a zero-day flaw in the Windows AppLocker driver (appid.sys) to gain kernel-level access to target systems.

Avast researchers observed North Korea-linked Lazarus APT group using an admin-to-kernel exploit for a zero-day vulnerability in the appid.sys AppLocker driver. 

The zero-day, tracked as CVE-2024-21338 has been addressed by Microsoft in the February Patch Tuesday update.

The nation-state actors exploited the zero-day to gain kernel-level access and disable security software. In past attacks threat actors achieved the same goal by using much noisier BYOVD (Bring Your Own Vulnerable Driver) techniques to cross the admin-to-kernel boundary. 

Lazarus exploited the vulnerability CVE-2024-21338 to perform direct kernel object manipulation in an updated version of their FudModule rootkit.

“the holy grail of admin-to-kernel is going beyond BYOVD by exploiting a zero-day in a driver that’s known to be already installed on the target machine. To make the attack as universal as possible, the most obvious target here would be a built-in Windows driver that’s already a part of the operating system.” reads the analysis published by Avast.

“Discovering an exploitable vulnerability in such a driver is significantly more challenging than in the previous BYOVD scenarios for two reasons. First, the number of possible target drivers is vastly smaller, resulting in a much-reduced attack surface. Second, the code quality of built-in drivers is arguably higher than that of random third-party drivers, making vulnerabilities much more difficult to find.” 

The new version of the rootkit can suspend PPL (Protected Process Light) protected processes associated with Microsoft Defender, CrowdStrike Falcon, and HitmanPro. 

The flaw CVE-2024-21338 resides within the IOCTL (Input and Output Control) dispatcher of the driver appid.sys. This driver is a core component of the AppLocker application, which is used to control which apps and files users can run. 

Lazarus exploited the zero-day in the appid.sys driver by manipulating the Input and Output Control (IOCTL) dispatcher. This manipulation allows them to arbitrary code on the target system, bypassing security measures.

“The entire goal of the admin-to-kernel exploit was to corrupt the current thread’s PreviousMode. This allows for a powerful kernel read/write primitive, where the affected user-mode thread can read and write arbitrary kernel memory using the Nt(Read|Write)VirtualMemory syscalls. Armed with this primitive, the FudModule rootkit employs direct kernel object manipulation (DKOM) techniques to disrupt various kernel security mechanisms. It’s worth reiterating that FudModule is a data-only rootkit, meaning it executes entirely from user space and all the kernel tampering is performed through the read/write primitive.” reads the report.

With their valuable admin-to-kernel zero-day exposed, Lazarus’s ability to bypass security has been significantly hampered. They must now choose between finding a new critical exploit or reverting to their older, less potent BYOVD tactics

The researchers noticed that with their valuable admin-to-kernel zero-day exposed, Lazarus’s ability to bypass security has been significantly hampered. They must now choose between finding a new critical exploit or reverting to their older, less potent BYOVD tactics.

Researchers published Indicators of Compromise (IoCs) and YARA for the latest version of the FudModule rootkit.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – ransomware, Lazarus)