CVE-2021-24094: Windows 10 TCP/IP RCE Vulnerability

CVE-2021-24094 Overview

CVE-2021-24094 is a critical remote code execution vulnerability affecting the Windows TCP/IP network stack. This vulnerability exists in the core networking component of Windows operating systems, allowing unauthenticated attackers to execute arbitrary code remotely without any user interaction. The flaw impacts the fundamental IPv6 protocol handling within the Windows kernel, making it particularly dangerous for enterprise environments with network-exposed systems.

Critical Impact

Unauthenticated remote attackers can execute arbitrary code with kernel-level privileges on vulnerable Windows systems by sending specially crafted network packets, potentially leading to complete system compromise.

Affected Products

• Microsoft Windows 10 (all versions including 1607, 1803, 1809, 1909, 2004, 20H2)
• Microsoft Windows 7 SP1
• Microsoft Windows 8.1
• Microsoft Windows RT 8.1
• Microsoft Windows Server 2008 SP2 and R2 SP1
• Microsoft Windows Server 2012 and R2
• Microsoft Windows Server 2016 (including 1909, 2004, 20H2)
• Microsoft Windows Server 2019

Discovery Timeline

• February 25, 2021 - CVE-2021-24094 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-24094

Vulnerability Analysis

This vulnerability resides in the Windows TCP/IP driver (tcpip.sys), which is a kernel-mode driver responsible for handling all TCP/IP network communications on Windows systems. The flaw is related to improper handling of IPv6 fragmented packets, specifically within the reassembly logic of the networking stack.

When processing specially crafted IPv6 packets with extension headers, the TCP/IP driver fails to properly validate buffer boundaries during packet reassembly. This allows an attacker to trigger memory corruption conditions that can be leveraged to achieve arbitrary code execution at the kernel level.

The vulnerability is particularly concerning because it requires no authentication and no user interaction. An attacker only needs network connectivity to a vulnerable system to exploit this flaw. The attack can be executed entirely remotely over the network, making it an attractive target for both automated scanning and targeted attacks.

Root Cause

The root cause stems from improper validation of IPv6 packet fragment headers during the reassembly process in the Windows TCP/IP kernel driver. The driver fails to properly verify the size and offset values provided in fragmented packet headers, leading to potential buffer overflow conditions when malformed packets are processed.

This type of vulnerability occurs when the kernel driver allocates memory based on declared packet sizes without adequately validating that the actual data conforms to these declarations. The mismatch between declared and actual buffer sizes creates an exploitable memory corruption condition.

Attack Vector

The attack vector for CVE-2021-24094 is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a target system with IPv6 enabled (default on modern Windows)
2. Crafting malicious IPv6 fragmented packets with malformed extension headers
3. Sending these packets to the target system over the network
4. Triggering the memory corruption during packet reassembly in the kernel

The vulnerability can be exploited from a remote location across the internet or from within the local network segment, depending on network configuration and firewall rules.

The exploitation mechanism involves sending IPv6 packets with carefully crafted fragment headers that manipulate the reassembly buffer allocation and write operations. When successful, this allows the attacker to overwrite critical kernel memory structures and redirect code execution to attacker-controlled payloads.

Detection Methods for CVE-2021-24094

Indicators of Compromise

• Unusual IPv6 traffic patterns with high volumes of fragmented packets from external sources
• System crashes or blue screens (BSOD) with tcpip.sys in the crash dump stack trace
• Anomalous kernel memory allocation patterns associated with network driver operations
• Unexpected code execution or process creation following network activity spikes

Detection Strategies

• Deploy network intrusion detection systems (IDS) with signatures for malformed IPv6 fragmented packets
• Monitor for suspicious IPv6 extension header combinations that are uncommon in legitimate traffic
• Implement endpoint detection rules for tcpip.sys crash events and kernel-level anomalies
• Enable Windows Event Logging for network driver errors and unexpected system restarts

Monitoring Recommendations

• Configure network monitoring tools to alert on IPv6 fragmentation anomalies and oversized fragment sequences
• Establish baseline network traffic patterns to identify deviations in IPv6 packet characteristics
• Monitor system stability metrics for patterns indicating potential exploitation attempts
• Review Windows Event Logs for driver-related errors referencing TCP/IP components

How to Mitigate CVE-2021-24094

Immediate Actions Required

• Apply the Microsoft security update immediately to all affected Windows systems
• If patching is not immediately possible, consider disabling IPv6 on systems that do not require it
• Implement network-level filtering to block suspicious IPv6 traffic at perimeter firewalls
• Prioritize patching for internet-facing systems and critical infrastructure

Patch Information

Microsoft has released security updates to address this vulnerability as part of their February 2021 Patch Tuesday release. The patch corrects the boundary validation logic in the TCP/IP driver's IPv6 packet reassembly routines.

For detailed patch information and download links, refer to the Microsoft Security Advisory CVE-2021-24094.

Organizations should deploy the appropriate update for their Windows version through Windows Update, Windows Server Update Services (WSUS), or by downloading the standalone package from the Microsoft Update Catalog.

Workarounds

• Disable IPv6 on systems where it is not required using the Network Adapter settings or Group Policy
• Block IPv6 traffic at network perimeter firewalls for systems that do not need external IPv6 connectivity
• Implement network segmentation to limit exposure of critical systems to potential attack vectors
• Use host-based firewalls to restrict inbound IPv6 traffic to only trusted sources

# Disable IPv6 via PowerShell (requires administrator privileges)
# This disables IPv6 on all adapters - use with caution
Get-NetAdapterBinding -ComponentID ms_tcpip6 | Disable-NetAdapterBinding -ComponentID ms_tcpip6

# Alternatively, disable IPv6 via registry (requires reboot)
# Set to 0xFF to disable all IPv6 components
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xFF /f