A newly released proof-of-concept (PoC) exploit has surfaced, targeting two significant zero-day vulnerabilities in Microsoft Windows that facilitate a groundbreaking “downgrade attack.” Identified as CVE-2024-38202 and CVE-2024-21302, these flaws were initially revealed by SafeBreach’s Alon Leviev at Black Hat USA 2024 and DEF CON 32 earlier this month.
These vulnerabilities enable attackers to exploit the Windows Update mechanism, covertly rolling back a fully updated Windows system to an earlier, insecure version. This regression effectively reactivates previously patched vulnerabilities, making once-fixed issues exploitable once more.
Leviev’s research highlights that this technique allows attackers to transform a fully patched Windows machine into one vulnerable to thousands of past exploits, thereby undermining the very concept of a “fully patched” system. The PoC, named “Windows Downdate,” has been made publicly available on GitHub and automates the exploitation process, allowing attackers to take control of the Windows Update process and implement “invisible, persistent, and irreversible downgrades” of essential OS components.
Windows Downdate can bypass various security mechanisms, including integrity checks and Trusted Installer protections, to downgrade crucial Windows DLLs, drivers, and even the NT kernel. It can also affect Credential Guard and Hyper-V components, thereby reintroducing previously fixed privilege escalation vulnerabilities.
The implications are severe: an attacker could surreptitiously revert a current Windows installation to a vulnerable state, reactivating numerous previously patched flaws. Current scanning and recovery tools are unable to detect these malicious downgrades.
Leviev’s research underscores that even a fully patched system is not immune to these stealthy downgrades, emphasizing the need for vigilance in addressing such security threats. While Microsoft acknowledged these vulnerabilities in advisories on August 7 and is working on fixes, no patches are yet available. Microsoft has suggested temporary mitigations, such as modifying access controls, but experts caution that these measures are insufficient and can be easily circumvented.
This situation highlights the risks associated with zero-day vulnerabilities in critical OS components and the importance of proactive research into these complex attack vectors. Leviev urges that operating systems, regardless of their age, should be continuously evaluated for potential security risks.
“Operating system design features should always be assessed as potential attack vectors, and all OS vendors need to be vigilant against these evolving threats,” Leviev stated.
