# Windows Kernel LPE CVE-2024-21338: Lazarus Group Exploits Zero-Day

> CISA adds CVE-2024-21338 to KEV catalog after Lazarus Group exploited the Windows Kernel vulnerability to deploy rootkits and bypass security controls.

- Published: 2026-04-29T12:41:40.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: CVE-2024-21338, Lazarus Group, Windows Kernel, CISA KEV, Rootkit, Privilege Escalation
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-flaw-exploited-in-zero-day-attacks/
- Canonical: https://runtimerebel.com/blog/windows-kernel-lpe-cve-2024-21338-lazarus-group-exploits-zero-day

## Key points

- Immediate impact: Attackers are leveraging a kernel-level flaw to bypass security software and gain full system control on Windows endpoints.
- Affected systems: Windows 10, 11, and Server versions 2016 through 2022 are vulnerable until the February 2024 patches are applied.
- Remediation: Administrators must deploy the Microsoft February 2024 security updates immediately to block active exploitation by nation-state actors.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added [CVE-2024-21338](/cve/cve-2024-21338) to its Known Exploited Vulnerabilities (KEV) catalog. This move follows reports that the [Lazarus Group](https://en.wikipedia.org/wiki/Lazarus_Group), a North Korean [APT](/glossary#apt), has been actively utilizing this [Zero-Day](/glossary#zero-day) vulnerability to gain kernel-level access on targeted systems. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-flaw-exploited-in-zero-day-attacks/), federal agencies are mandated to patch this vulnerability by March 21, 2024, highlighting the urgency for both public and private sectors to address the threat.

## Technical Analysis of Windows Kernel elevation of privilege CVE-2024-21338

This [CVE](/glossary#cve) represents a [Privilege Escalation](/glossary#privilege-escalation) vulnerability within the Windows Kernel. Specifically, the flaw exists in the AppLocker driver (`appid.sys`), which is responsible for application identity services. The vulnerability arises from an improper handling of input/output control (IOCTL) requests. An attacker who already has local access to a system can exploit this flaw to transition from administrative privileges to the kernel level, effectively bypassing the security boundary between user mode and kernel mode.

While Microsoft initially assigned this vulnerability a [CVSS](/glossary#cvss) score of 7.8, its real-world impact is significant because it facilitates an "admin-to-kernel" transition. In modern security architectures, reaching the kernel is the ultimate objective for attackers seeking to maintain persistence and evade detection. By operating at the kernel level, the [Lazarus Group](https://en.wikipedia.org/wiki/Lazarus_Group) can manipulate system processes in a way that is invisible to standard security tools running in user space.

## Lazarus Group rootkit deployment

Security researchers identified that the Lazarus Group integrated the exploit for CVE-2024-21338 into an updated version of their FudModule rootkit. This specific [TTP](/glossary#ttp) allows the actor to perform direct kernel object manipulation (DKOM). By altering kernel structures, the rootkit can disable security products, such as [EDR](/glossary#edr) and antivirus agents, by unregistering their callbacks or terminating their protected processes. 

This capability is a cornerstone of the Lazarus Group's recent campaigns. By disabling defensive software, the attackers ensure that their subsequent activities—such as establishing [C2](/glossary#c2) channels or moving laterally—remain undetected. This exploitation chain demonstrates a sophisticated understanding of Windows internals, specifically targeting drivers that are typically trusted by the operating system.

### How to detect CVE-2024-21338 exploit

Identifying the use of this exploit requires monitoring for unusual activity related to the `appid.sys` driver. Defenders should configure their [SIEM](/glossary#siem) to flag any process other than the legitimate application identity service that attempts to interact with IOCTL codes associated with the AppLocker driver. 

Furthermore, [SOC](/glossary#soc) teams should look for signs of security software failure. If an EDR agent suddenly stops reporting or its service is unexpectedly terminated on a host that has not been patched for the February 2024 cycle, it may indicate a successful [Lateral Movement](/glossary#lateral-movement) attempt or local escalation via the FudModule rootkit. Monitoring for the [MITRE ATT&CK](/glossary#mitre-att-ck) technique 'Rootkit' (T1014) is essential in this context.

## Remediation and Mitigation

The primary remediation step is the immediate application of the Microsoft February 2024 cumulative updates. These patches address the IOCTL handling logic in the kernel to prevent the elevation of privilege. Beyond patching, organizations should adopt a [Zero Trust](/glossary#zero-trust) architecture, ensuring that even users with administrative rights are strictly monitored and that their ability to load or interact with kernel drivers is limited by policy. Hardening the environment against unauthorized driver loading and utilizing hardware-based security features, such as Virtualization-Based Security (VBS), can provide additional layers of defense against kernel-mode threats.

**Related:** [CVE-2022-21882: CISA Warns of Windows Task Host Exploit in the Wild](/blog/cve-2022-21882-cisa-warns-of-windows-task-host-exploit-in-the-wild), [CVE-2026-35616: Critical FortiClient EMS API Bypass Exploited](/blog/cve-2026-35616-critical-forticlient-ems-api-bypass-exploited)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/windows-kernel-lpe-cve-2024-21338-lazarus-group-exploits-zero-day