CVE-2024-38160
Heap-based Buffer Overflow (CWE-122)
Summary
Windows Network Virtualization Remote Code Execution Vulnerability. This is a critical vulnerability with a CVSS base score of 9.1. It affects Windows systems and allows for remote code execution. The vulnerability has a low attack complexity, requires no user interaction, and can be exploited over the network. However, it does require high privileges for exploitation.
Impact
If exploited, this vulnerability could allow an attacker to execute arbitrary code on the target system with high impact on confidentiality, integrity, and availability. The scope is changed, indicating that the vulnerability not only affects the vulnerable component but may also impact components beyond its security scope. Given the high privileges required, an attacker who successfully exploits this vulnerability could potentially gain significant control over the affected system, leading to data theft, system compromise, or service disruption.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft has released an official fix for this vulnerability on August 13, 2024.
Mitigation
1. Apply the official patch released by Microsoft as soon as possible. 2. Implement network segmentation to limit the exposure of vulnerable systems. 3. Monitor for suspicious network activity, especially targeting Windows Network Virtualization components. 4. Ensure that only necessary accounts have high-level privileges, as the vulnerability requires high privileges to exploit. 5. Keep all Windows systems and software up to date with the latest security updates. 6. Implement strong access controls and authentication mechanisms to prevent unauthorized access to systems with high privileges.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Timeline
Detection for the vulnerability has been added to Qualys (92160)
A CVSS base score of 9.1 has been assigned.
Feedly found the first article mentioning CVE-2024-38160. See article
NVD published the first details for CVE-2024-38160
Feedly estimated the CVSS score as HIGH
CVE-2024-38160 is a critical vulnerability in Windows Network Virtualization with a CVSS score of 9.1, allowing for remote code execution. It is currently being exploited in the wild by threat actors, and there are no known mitigations or patches available. This vulnerability may have downstream impacts on other third-party vendors or technologies utilizing Windows Network Virtualization. See article
EPSS Score was set to: 0.07% (Percentile: 30.1%)