CVE-2024-21338

What is the Windows AppLocker Kernel Driver (appid.sys)?

The Windows AppLocker Application Identity driver (appid.sys) is a kernel-mode driver that supports Windows AppLocker — the feature that enforces application control policies restricting which programs can execute on a system. appid.sys exposes an IOCTL (Input/Output Control) interface that allows user-mode processes to interact with the AppLocker enforcement engine. Because kernel drivers expose IOCTLs to user-mode, the access control on these IOCTLs is critical — insufficient access controls allow low-privilege processes to invoke kernel operations that should be restricted to privileged callers.

Overview

CVE-2024-21338 is a zero-day vulnerability in the Windows AppLocker kernel driver (appid.sys) involving an exposed IOCTL with insufficient access control and an untrusted pointer dereference. It was discovered and exploited by North Korea's Lazarus Group to deploy the FudModule kernel rootkit — a sophisticated tool that manipulates Windows security telemetry and disables EDR sensors from the kernel level. Avast researchers discovered the exploitation in the wild and attributed it to Lazarus Group. This is the first Lazarus FudModule deployment that used a genuine kernel zero-day (as opposed to the BYOVD technique used in earlier FudModule deployments).

Affected Versions

Technical Details

CWE-822 (Untrusted Pointer Dereference). The appid.sys driver's IOCTL handler processes requests from user-mode processes. A flaw in access control validation allows a low-privilege process to send IOCTLs that should be restricted to higher-privilege callers. Additionally, the IOCTL handler dereferences a pointer provided in the IOCTL input buffer without adequate validation — an untrusted pointer dereference that allows an attacker to specify an arbitrary kernel address to read from or write to.

Lazarus Group's exploitation path: low-privilege user process → send crafted IOCTL to appid.sys → trigger untrusted pointer dereference → achieve kernel write primitive → overwrite kernel security objects to gain SYSTEM → deploy FudModule rootkit which disables ETW kernel telemetry, removes EDR minifilter callbacks, and neutralizes Windows security mechanisms.

FudModule marks a significant evolution: earlier versions (2022–2023) used Bring Your Own Vulnerable Driver (BYOVD) to achieve kernel access; CVE-2024-21338 allowed the same rootkit to be deployed without bringing an external driver, reducing detection risk significantly.

Discovery

Discovered by Jan Vojtěšek and the Avast Threat Research team, who identified FudModule samples in the wild that exploited a new technique (real kernel zero-day rather than BYOVD) and reverse-engineered the appid.sys vulnerability. Avast reported to Microsoft, which patched in February 2024 Patch Tuesday.

Exploitation Context

The Lazarus Group (North Korea's primary APT, also known as APT38, Hidden Cobra) uses FudModule rootkit deployments as part of cryptocurrency theft operations targeting financial institutions and cryptocurrency exchanges. The rootkit's ability to disable Windows security telemetry and EDR sensors makes post-exploitation activity invisible, enabling prolonged access. CVE-2024-21338 was a significant capability upgrade: a zero-day kernel vulnerability without requiring a vulnerable driver binary makes the attack harder to detect and removes a common BYOVD detection signal.

Remediation

1. Apply the February 2024 Windows security updates (Patch Tuesday, February 13, 2024) immediately.
2. Enable virtualization-based security (VBS) and Hypervisor-Protected Code Integrity (HVCI) — these protect kernel code integrity and significantly complicate kernel rootkit deployment.
3. Deploy EDR solutions with self-protection mechanisms (kernel tamper protection) that resist FudModule's callback removal techniques.
4. Monitor for AppLocker-related unusual kernel events and for ETW telemetry gaps that may indicate FudModule is suppressing security events.
5. Cryptocurrency industry organizations should treat Lazarus Group as an active threat and verify full patch compliance for this and related CVEs.