Microsoft Gaming Services Elevation-of-Privilege Vulnerability

Summary

A vulnerability researcher has found a way to exploit Microsoft Xbox Gaming Services store application to perform an elevation of privileges from a user to SYSTEM level. The vulnerability categorized as CVE-2024-28916 (CVSS: 8.8) allows for a local attacker with the ability to create folder and performance traces on the machine to gain SYSTEM level privileges. Proof of concept exploit code was developed by security researcher Filip Dragović and reported to Microsoft, which subsequently patched/mitigated the vulnerability.

Impact Assessment

This vulnerability allows for a local attacker to perform an elevation of privilege. It impacts all devices that utilize the Xbox Gaming Services application from the Microsoft Store and only requires typical user level privileges.

Remediation

Version 19.87.13001.0 or later will remediate this vulnerability. This is patched automatically through the Microsoft Store, it can also be updated by opening the Microsoft Store, navigating to library, and either selecting “Get Updates” and “Update All”.

What It Means for You

If this service is not a part of your organization’s normal business operations, we recommended that you block the service and remediate. This will help reduce your attack surface and thereby mitigate the vulnerability.

Business Implications

Since the vulnerability allows for a local attacker to gain SYSTEM level privileges, exploitation could be severe. Data loss/exfiltration and lateral movement are possible from the targeted machine once SYSTEM privileges are obtained. Monetary loss from incident response and potential fallout from data being exfiltrated or malware being installed should be expected.

Access Point Consulting Recommends

Patch: If you utilize this service, patch to version 19.87.13001.0 or later, this should be done through the Microsoft Store.

Through PowerShell you can run a command to check your version:

get-appxpackage Microsoft.GamingServices

Mitigate: If your organization does not need this service, block or uninstall it during a device build process.

Associated Bulletins

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28916

https://github.com/Wh04m1001/GamingServiceEoP/tree/main/Project16

‍