Integer Underflow (Wrap or Wraparound) (CWE-191)
Windows TCP/IP Remote Code Execution Vulnerability. This is a critical vulnerability affecting the TCP/IP implementation in Windows. It allows for remote code execution without requiring user interaction and can be exploited over the network with low attack complexity. No privileges are needed to exploit this vulnerability.
This vulnerability has a high impact on confidentiality, integrity, and availability. If exploited, an attacker could execute arbitrary code on the target system, potentially leading to full system compromise. The attacker could install programs, view, change, or delete data, or create new accounts with full user rights. Given its network attack vector and the lack of required user interaction, it could potentially be used for widespread attacks across multiple systems.
Multiple proof-of-concept exploits are available on github.com, github.com, github.com, github.com. Its exploitation has been reported by various sources, including kill-the-newsletter.com.
A patch is available. Microsoft released an official fix for this vulnerability on August 13, 2024. The security update should be applied as soon as possible to mitigate the risk.
1. Apply the security update provided by Microsoft immediately. 2. Implement network segmentation and firewall rules to limit exposure of vulnerable systems. 3. Monitor for suspicious network activity that could indicate exploitation attempts. 4. Keep all Windows systems up to date with the latest security patches. 5. Consider disabling or restricting access to TCP/IP services on critical systems until patching is complete. 6. Implement the principle of least privilege across your network to minimize potential impact.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Detection for the vulnerability has been added to Qualys (92160)
A CVSS base score of 9.8 has been assigned.
Feedly found the first article mentioning CVE-2024-38063. See article
NVD published the first details for CVE-2024-38063
CVE-2024-38063 is a critical Remote Code Execution vulnerability affecting Windows TCP/IP with a CVSSv3 score of 9.8. It is rated as “Exploitation More Likely” and can be exploited remotely by sending specially crafted IPv6 packets. Microsoft has released patches for all supported versions of Windows, and mitigation suggestions include disabling IPv6 to prevent exploitation. See article
This CVE started to trend in security discussions
This CVE stopped trending in security discussions
Attacks in the wild have been reported by SANS NewsBites. See article
A CVSS base score of 9.8 has been assigned.