Incorrect Check of Function Return Value (CWE-253)
Windows Hyper-V is vulnerable to a denial of service attack. This vulnerability is associated with uncontrolled resource consumption and incorrect checking of function return values. It affects various versions of Windows Server, including Server 2012, 2016, 2019, 2022, and 2022 (version 23H2).
An attacker exploiting this vulnerability could cause a denial of service condition in Windows Hyper-V. This could potentially disrupt the availability of virtualized resources and services running on affected Windows Server systems. The attack can be initiated remotely over a network without requiring user interaction or elevated privileges, making it relatively easy to exploit.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available for this vulnerability. Microsoft has released updates to address the issue across multiple affected Windows Server versions.
To mitigate this vulnerability, it is strongly recommended to apply the latest security updates provided by Microsoft for the affected Windows Server versions. Specifically: 1. For Windows Server 2022 (23H2), update to version 10.0.25398.1189 or later. 2. For Windows Server 2016, update to version 10.0.14393.7428 or later. 3. For Windows Server 2019, update to version 10.0.17763.6414 or later. 4. For Windows Server 2022, update to version 10.0.20348.2762 or later. 5. For Windows Server 2012 and Windows Server 2012 R2, apply the latest available security updates. Additionally, consider implementing network segmentation and access controls to limit potential attack vectors to Hyper-V systems. Regularly monitor system resources and logs for any unusual activity or performance issues that could indicate exploitation attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
A CVSS base score of 7.5 has been assigned.
Feedly found the first article mentioning CVE-2024-43521. See article
Feedly estimated the CVSS score as MEDIUM
CVE-2024-43521 is a Denial of Service (DoS) vulnerability with an important severity rating and a CVSSv3 score of 7.5. The provided information does not indicate whether it is being exploited in the wild, nor does it mention any proof-of-concept exploits, mitigations, detections, patches, or downstream impacts to other third-party vendors or technology. Further investigation would be necessary to assess the full implications of this vulnerability. See article
NVD published the first details for CVE-2024-43521
EPSS Score was set to: 0.05% (Percentile: 17.8%)
EPSS Score was set to: 0.06% (Percentile: 28.5%)