CVE-2024-38105
Improper Input Validation (CWE-20)
Summary
A vulnerability in the Windows Layer-2 Bridge Network Driver could allow an attacker to cause a Denial of Service condition. This issue is classified as a Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability and is associated with improper input validation (CWE-20). The vulnerability has a CVSS v3.1 base score of 6.5, categorizing it as a medium severity issue.
Impact
An attacker exploiting this vulnerability could cause a Denial of Service condition, potentially disrupting the availability of the affected system. The attack vector is adjacent network, meaning the attacker would need to be on the same network segment as the target. The vulnerability requires no user interaction and no privileges to exploit. While there is no impact on confidentiality or integrity, the availability impact is rated as high.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft released a security update to address this vulnerability on July 9, 2024. It is strongly recommended to apply this patch as soon as possible to mitigate the risk.
Mitigation
1. Apply the security update provided by Microsoft as soon as possible. 2. Implement network segmentation to limit the potential attack surface. 3. Monitor for unusual network activity, particularly from adjacent network segments. 4. Ensure that only trusted devices are allowed on the same network segment as critical systems. 5. Implement robust input validation mechanisms across all network interfaces.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Timeline
Detection for the vulnerability has been added to Qualys (92149)
A CVSS base score of 6.5 has been assigned.
NVD published the first details for CVE-2024-38105
Feedly found the first article mentioning CVE-2024-38105. See article
Feedly estimated the CVSS score as MEDIUM
This CVE started to trend in security discussions
EPSS Score was set to: 0.04% (Percentile: 13%)
This CVE stopped trending in security discussions