Microsoft has disclosed a critical (CVSS 9.8) TCP/IP remote code execution (RCE) vulnerability that impacts all Windows systems utilizing IPv6. To conduct this attack, threat actors can repeatedly send IPv6 packets that include specially crafted packets. By doing this, an unauthenticated attacker could exploit this vulnerability, leading to remote code execution. Systems that have IPv6 disabled are not susceptible to this vulnerability.
Technical Details
CVE-2024-38063 is a zero-click vulnerability that utilizes specially crafted packets to trigger a buffer overflow vulnerability that can be used to execute arbitrary code on vulnerable Windows 10, Windows 11, and Windows Server systems. Minimal details on the specific nature of this attack have not been released to the public, as the researcher who discovered and disclosed this vulnerability to Microsoft stated (Tweet from the researcher), “Considering its harm, I will not disclose more details in the short term.”
At the time of this report, Trustwave has not seen any proof-of-concepts posted publicly or in the underground. Additionally, Trustwave has not identified any weaponization or productization of this vulnerability. However, there has been chatter on various dark web forums and chats about this vulnerability, indicating an interest from malicious actors to take advantage of this vulnerability. Due to this reported low complexity of exploitation and overall chatter on this vulnerability, it is likely that Trustwave will continue to monitor the situation and provide updates as more information becomes available.
Mitigations
Trustwave analysts recommend client organizations implement the below mitigations to improve your organization’s cybersecurity readiness and posture based on the threat actors’ outlined activity.
- Implement the patch released by Microsoft for systems that cannot disable IPv6
- This patch was released on August 13, 2024. A link to download the patch that is appropriate for the vulnerable system can be found in a reference link below. This patch will remediate this vulnerability
- If you are unable to patch vulnerable systems, ensure IPv6 is disabled. This feature is ON by default.
References
