CVE-2024-26248 & CVE-2024-29056: Managing PAC Validation Changes

Managing PAC Validation Changes for CVE-2024-26248 & CVE-2024-29056: A Deep Dive
In today’s fast-paced security landscape, staying ahead of vulnerabilities is key. Microsoft’s recent 30-day notice highlights important changes in the way Windows handles Kerberos PAC (Privilege Attribute Certificate) Validation for two critical vulnerabilities: CVE-2024-26248 and CVE-2024-29056. This article provides an in-depth look at these changes, explains what PAC Validation is, and offers step-by-step recommendations to protect your Windows environment.

---

Understanding PAC Validation and Its Role in Windows Security​

PAC Validation is a core part of the Kerberos authentication process. The Privilege Attribute Certificate, embedded within Kerberos service tickets, carries information about authenticated users and their privileges. Correct validation of this certificate ensures that only legitimate processes and users can elevate their privileges—a fundamental aspect of Windows security.
The update addresses two vulnerabilities:

• CVE-2024-26248: Allows a process’s user to spoof signatures and bypass PAC validation checks.
• CVE-2024-29056: Affects certain cross-forest scenarios where trust boundaries and information filtering can be exploited.

By mitigating these vulnerabilities, Microsoft aims to prevent potential local privilege escalation attacks that could compromise entire domains.

---

Timeline of the Update Phases​

Microsoft’s strategy for rolling out these changes follows a staged timeline that ensures a smooth transition while minimizing disruptions. Here’s the breakdown:

1. April 9, 2024 – Initial Deployment (Compatibility Mode)
   • What’s Happening?
     The security update introduces a new behavior for PAC Validation that prevents elevation of privilege attacks. However, by default, this behavior is implemented in Compatibility mode. This means:
     • Devices that aren’t fully updated will revert to old request structures.
     • Audit events are logged to help administrators identify devices that are not updated.
   • Why It Matters:
     In this phase, even if your environment is partially updated, legacy support is maintained, though with inherent vulnerabilities still present if the entire fleet isn’t patched.
2. January 2025 – Enforced by Default Phase
   • What’s Happening?
     Updates released in this period will automatically push all updated Windows domain controllers and clients into Enforced mode. In this mode, secure behavior is enforced by default.
   • Administrator Actions:
     Any pre-existing registry settings can still override the default behavior, giving IT admins flexibility during the migration period.
3. April 2025 – Full Enforcement Phase
   • What’s Happening?
     The Windows security updates released in this phase will remove support for registry subkeys (such as PacSignatureValidationLevel and CrossDomainFilteringLevel) and fully enforce secure PAC Validation behavior.
   • Impact:
     No fallback to Compatibility mode is available, making it essential to have your environment fully updated and compliant before this phase arrives.

Summary of the Timeline:

• April 9, 2024: Compatibility mode launched with fallbacks and detailed logging.
• January 2025: Transition to Enforced mode by default, with the possibility to override via registry settings.
• April 2025: Final phase; legacy compatibility options are removed, sealing the security enhancements.

---

Step-by-Step Recommendations for Administrators​

Ensuring your environment is secure against CVE-2024-26248 and CVE-2024-29056 involves careful planning and execution. Here’s a checklist for IT administrators:

1. Update Your Entire Fleet:
   • Domain Controllers & Clients:
     Make sure that all Windows domain controllers and client machines receive the update released on or after April 9, 2024. A piecemeal update could leave critical links in your network vulnerable.
   • Operating Systems:
     The affected platforms range widely—from legacy Windows Server versions and Windows 10 (various versions and editions) to current Windows 11 builds. Note that Windows 10 support will end in October 2025, so this update is part of a broader push towards modernizing environments.
2. Monitor Audit Events:
   • Enabled Audit Logging:
     Keep an eye on audit logs that record Kerberos Ticket Logon events. These logs will provide critical information about devices that haven’t yet adopted the proper update or have fallback occurrences.
   • Critical Event IDs to Watch:
     • Event ID 21: Informational events during Network Ticket Logon.
     • Event ID 22: Errors indicating denial of authentication when encountering unpatched domain controllers.
     • Event ID 23: Warnings and errors when fallback to previous behavior occurs.
3. Prepare for the Enforcement Phases:
   • Registry Adjustments:
     Until the final enforcement in April 2025, administrators can manage behavior using specific registry settings:
     • PacSignatureValidationLevel:
     • Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
     • Default Value for Compatibility: 3
     • CrossDomainFilteringLevel:
     • Same registry path with a default value of 4.
     • AuditKerberosTicketLogonEvents:
     • Configurable for different levels, ensuring that logs capture either critical events or all events as needed.
   • Testing in a Lab Environment:
     Before pushing changes to production, it’s wise to test PAC Validation behavior in a controlled setting. This helps identify potential cross-forest filtering failures or Netlogon issues that might arise.
4. Communicate with Your Teams:
   • Ensure that all relevant IT staff are informed about these updates. Collaborative planning between administrators handling domain controllers, network security experts, and help desk teams can reduce risks of outages during enforcement.

Quick Checklist:

• ☐ Update all Windows devices (domain controllers + clients) starting April 9, 2024.
• ☐ Enable and monitor Kerberos audit logs for Event IDs 21, 22, and 23.
• ☐ Adjust registry keys as necessary until full enforcement in April 2025.
• ☐ Run tests in lab environments to ensure smooth rollout.
• ☐ Prepare to transition to Windows 11 if running outdated Windows 10 versions, given the upcoming end-of-life for Windows 10 support.

---

Registry Keys and Detailed Mitigation​

For those who enjoy the nitty-gritty details, the registry is where the rubber meets the road. Understanding and correctly configuring these keys is critical during the transition period.

Detailed Registry Key Overview​

• PacSignatureValidationLevel
  • Path:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
  • Data Type: REG_DWORD
  • Default Setting: 3 (for compatibility mode)
  • Function:
    Controls the strictness of PAC signature validation. Setting a higher level (Enforce) bolsters protection but requires all relevant domain controllers to support the new mechanism.
• CrossDomainFilteringLevel
  • Path:
    Same as above.
  • Data Type: REG_DWORD
  • Default Setting: 4
  • Function:
    Manages the filtering of authorization data across trusted domains. Again, adjustments here ensure that cross-forest traffic doesn’t inadvertently open the door to security breaches.
• AuditKerberosTicketLogonEvents
  • Usage:
    This optional registry key can be deployed on both Windows servers and domain controllers to capture detailed log events, which are invaluable during the transitional phases.

Why Registry Settings Matter​

Configuring these keys enables administrators to:

• Override default behavior if needed.
• Provide a fallback mechanism (Compatibility mode) until the environment is fully updated.
• Gradually enforce stricter security without abruptly breaking trust relationships across domains.

By tuning these registry settings, you ensure that even if your domain environment is heterogeneous (with both updated and legacy systems), the transition to enforced PAC validation is as seamless as possible.

---

Real-World Implications and Practical Considerations​

Imagine the potential fallout if only half of your network is patched. A legacy domain controller could fail to recognize the new request structure used by updated workstations, potentially causing authentication fallbacks or, worse, allowing attackers a chance to slip through with spoofed credentials. In a cross-domain or cross-forest environment, this risk is compounded by the added complexity of trusts and authorization filtering.
Real-World Case Example:
An enterprise with multiple domain controllers spread across different regions found that incomplete updates during the staging phase led to several authentication fallbacks being logged (indicated by Event IDs 23 and 5843). After a coordinated update across all branches and enforcing the new registry settings, the network not only became secure but audit logs confirmed that legacy operations had ceased entirely.
This is a prime example of proactive IT management—ensuring that security isn’t left to chance by updating the entire fleet simultaneously, thereby mitigating risks before they can be exploited.

---

Final Thoughts​

The update addressing CVE-2024-26248 and CVE-2024-29056 is a prime reminder that in the world of Windows security, vigilance is essential. From understanding the nuances of PAC Validation to implementing a phased update strategy that spans almost a year, the roadmap is both detailed and critical.
Key Takeaways:

• Holistic Updates: Ensure both domain controllers and clients are updated to avoid compatibility pitfalls.
• Monitoring: Use audit events to track progress and detect any rollout issues early.
• Registry Controls: Utilize registry keys to manage behavior until complete enforcement in April 2025.
• Plan Ahead: With Windows 10 support ending in October 2025, now is the time to plan your transition strategy towards Windows 11 or beyond.

In essence, these changes may seem technical at first glance, but they form a crucial line of defense against local elevation of privilege attacks. As Windows administrators and IT professionals, it’s our mission to remain diligent, proactive, and thoroughly informed. So, roll up those sleeves, review your update schedules, and let’s keep our networks secure—because no one likes a security loophole that’s been left ajar.
Stay safe and keep those domain controllers updated!

---

Source: Unknown Source How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056 - Microsoft Support