An analysis of the critical flaw in the Windows IPv6 TCP/IP stack
Take action: The flaw lies in the Windows kernel’s IPv6 parser and can be exploited even if the system’s firewall is active, as the malicious packets would be processed before they reach the firewall. Time to patch, or disable IPv6 on Windows risking network issues.
Learn More
Microsoft released patch for a critical Windows TCP/IP Remote Code Execution (RCE) vulnerability as part of its August Patch Tuesday updates. Tracked as CVE-2024-38063 (CVSS score 9.8) and has generated significant discussion within the cybersecurity community due to its potential impact. The vulnerability is classified as "wormable," meaning it could spread across networks without user interaction.
CVE-2024-38063 is an Integer Underflow vulnerability affecting the IPv6 protocol on Windows systems. It allows unauthenticated attackers to remotely execute code by sending specially crafted IPv6 packets. If successfully exploited, this vulnerability could lead to a buffer overflow, enabling arbitrary code execution on targeted systems running Windows 10, Windows 11, and Windows Server versions.
Cybersecurity expert Marcus Hutchins highlighted that the issue lies within the Windows kernel’s IPv6 parser and could be exploited even if the system’s firewall is active, as the malicious packets would be processed before they reach the firewall.
The vulnerability impacts all current Windows versions:
- Windows 10
- Windows 11
- Windows Server
Microsoft has provided guidance stating that systems are not affected if IPv6 is disabled. However, opinions vary on whether disabling IPv6 is a viable mitigation. While some security professionals argue that disabling IPv6 is an effective approach, especially if it is not in use, others caution that this could introduce operational risks in environments where IPv6 is essential.
- Brian Hysell, Associate Principal Consultant at Synopsys Software Integrity Group, recommends applying the patch as the primary solution, noting that disabling IPv6 could lead to unexpected issues in larger organizations.
- Chris Bates, CISO at SandboxAQ, supports disabling IPv6 if it is not actively used, framing it as a straightforward method for reducing the attack surface.
- Stephen Fewer, Principal Security Researcher at Rapid7, emphasizes that this vulnerability is specific to Microsoft’s implementation of IPv6. He advises organizations to apply the patch quickly, especially in environments where disabling IPv6 could disrupt business-critical operations.
Update - A proof-of-concept (PoC) exploit code for CVE-2024-38063, has been released, making it easier for threat actors to exploit the flaw. This vulnerability affects Windows 10, Windows 11, and Windows Server systems with IPv6 enabled.
