Vulnerability description:
CVE-2024-38063The vulnerability is rooted in the handling of IPv6 packets in the Windows TCP/IP stack. An unauthenticated attacker can exploit this vulnerability by sending specially crafted IPv6 packets to the target system, resulting in Remote Code Execution (RCE). Such attacks allow an attacker to execute arbitrary code on an affected system and potentially take full control of the system.
CVE-2024-38063 is particularly dangerous because it requires no user interaction or special privileges, making it highly likely to be exploited. Microsoft has released a patch and it is vital that users ensure their systems are up to date.
Impact of the vulnerability:
This vulnerability currently affects all windows systems with IPV6 enabled. The vulnerability exists in TCP/IP, which is known to be the fundamental suite of protocols that underpin the Internet.TCP/IP facilitates communication between different networks, and any disruption or exploitation of this core component could have wide-ranging implications.
Although CVE-2024-38063 is not actively exploited at this time, its potential for damage is significant. Microsoft has categorized this vulnerability as "more likely" to be exploited, meaning it could be a target for threat actors to compromise systems with minimal effort. The vulnerability's low attack complexity and lack of user interaction is an attractive prospect for attackers.
Vulnerability discovery:
Mr. Wei, a security researcher on the Cyber KunLun team at KunLun Labs, discovered the vulnerability and reported it to Microsoft. Although there is no public Proof of Concept (PoC) yet, the severity of the vulnerability has caused thecyber securityWidespread interest in the community.
Mitigation options:
Microsoft has urged organizations to prioritize patching this vulnerability on all affected servers. Given the low level of sophistication of the attack vector and the criticality of the issue, delayed patching could put systems at significant risk. Organizations that rely on IPv6 for network communications should immediately assess their infrastructure and apply the necessary updates.
For systems where IPv6 is not essential, disabling it can be used as a temporary relief until the patch is fully applied.
refer to:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063
https://www.cve.org/CVERecord?id=CVE-2024-38063
Original article by Chief Security Officer, if reproduced, please credit https://cncso.com/en/cve-2024-38063-0-click-rce-affects-all-windows-systems-html
