CVE-2022-32230: Windows SMBv3 DoS Vulnerability

CVE-2022-32230 Overview

Microsoft Windows SMBv3 suffers from a null pointer dereference vulnerability in versions of Windows prior to the April 2022 patch set. By sending a malformed FileNormalizedNameInformation SMBv3 request over a named pipe, an attacker can cause a Blue Screen of Death (BSOD) crash of the Windows kernel. For most systems, this attack requires authentication, except in the special case of Windows Domain Controllers, where unauthenticated users can always open named pipes as long as they can establish an SMB session. Typically, after the BSOD, the victim SMBv3 server will reboot.

Critical Impact

This vulnerability enables remote denial of service attacks against Windows systems, causing system crashes and forced reboots. Windows Domain Controllers are particularly at risk as they can be targeted without authentication.

Affected Products

• Microsoft Windows 10 (versions 20H2, 21H1, 21H2, 1809)
• Microsoft Windows 11
• Microsoft Windows Server 2019

Discovery Timeline

• 2022-06-14 - CVE-2022-32230 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-32230

Vulnerability Analysis

This vulnerability is classified as CWE-476 (Null Pointer Dereference), a memory corruption flaw that occurs when the Windows SMBv3 driver attempts to dereference a null pointer during the processing of specially crafted network requests. The flaw resides in how the SMBv3 implementation handles FileNormalizedNameInformation queries sent over named pipes.

When a malformed request is received, the kernel fails to properly validate the pointer before dereferencing it, leading to an unrecoverable kernel exception. This results in an immediate Blue Screen of Death (BSOD), forcing the affected system to reboot. The attack is network-accessible and requires no user interaction, making it particularly dangerous for exposed SMB services.

Root Cause

The root cause of this vulnerability is improper pointer validation in the Windows SMBv3 kernel driver. When processing FileNormalizedNameInformation requests over named pipes, the driver fails to check whether a pointer is null before attempting to access the memory location it references. This missing null check allows attackers to trigger a kernel crash by sending specially crafted SMBv3 packets that cause the vulnerable code path to attempt dereferencing an invalid memory address.

Attack Vector

The attack is delivered over the network via SMBv3 protocol. An attacker must be able to establish an SMB session with the target system. For standard Windows systems, this typically requires valid authentication credentials. However, Windows Domain Controllers present an elevated risk because unauthenticated users can open named pipes as long as they can establish an initial SMB session, making them vulnerable to unauthenticated denial of service attacks.

The attack flow involves:

1. Establishing an SMB session with the target server
2. Opening a named pipe connection
3. Sending a malformed FileNormalizedNameInformation request
4. The Windows kernel crashes with a BSOD due to the null pointer dereference
5. The system automatically reboots, causing service disruption

A Metasploit module has been developed for this vulnerability. For technical details, see the GitHub Metasploit Module.

Detection Methods for CVE-2022-32230

Indicators of Compromise

• Unexpected system crashes with BSOD referencing SMB-related kernel drivers
• Abnormal SMBv3 traffic patterns targeting named pipes with FileNormalizedNameInformation queries
• Windows Event Log entries showing kernel crashes (Event ID 41, 1001) with SMBv3-related crash dumps
• Repeated system reboots without apparent cause on exposed SMB servers

Detection Strategies

• Monitor for anomalous SMBv3 traffic, particularly requests containing malformed FileNormalizedNameInformation queries
• Implement network intrusion detection rules to identify exploit attempts targeting SMBv3 named pipe operations
• Deploy endpoint detection and response (EDR) solutions capable of detecting kernel-level anomalies and crash patterns
• Analyze crash dumps for null pointer dereference exceptions in SMBv3-related kernel code

Monitoring Recommendations

• Enable detailed Windows Event logging for SMB server activity and system crashes
• Configure SIEM alerts for patterns of repeated system reboots on critical infrastructure, especially Domain Controllers
• Implement network flow analysis to detect unusual SMBv3 traffic patterns from external or untrusted sources
• Monitor for exploitation framework signatures such as the Metasploit module targeting this vulnerability

How to Mitigate CVE-2022-32230

Immediate Actions Required

• Apply the Microsoft security updates released in April/May 2022 immediately to all affected systems
• Prioritize patching Windows Domain Controllers as they are vulnerable to unauthenticated attacks
• Restrict SMB access to trusted networks only using firewall rules (block port 445 from untrusted sources)
• Review network segmentation to limit exposure of SMB services to the internet

Patch Information

Microsoft has released security updates to address this vulnerability. The fix was included in the April 2022 cumulative updates. For detailed patch information, refer to:

• Microsoft Update Guide CVE-2022-32230
• Microsoft KB5013942 Update (OS Builds 19042.1706, 19043.1706, and 19044.1706)

For additional analysis, see the Rapid7 Blog Analysis.

Workarounds

• Block SMBv3 traffic (TCP port 445) at the network perimeter to prevent external exploitation
• Implement network segmentation to isolate critical SMB servers from untrusted network segments
• Disable SMBv3 on systems where it is not required (note: this may impact functionality)
• Configure Windows Firewall to restrict SMB access to specific trusted IP addresses only

# Windows Firewall configuration to restrict SMB access
netsh advfirewall firewall add rule name="Block SMB Inbound" dir=in action=block protocol=tcp localport=445

# Allow SMB only from trusted subnet (example: 10.0.0.0/24)
netsh advfirewall firewall add rule name="Allow SMB Trusted" dir=in action=allow protocol=tcp localport=445 remoteip=10.0.0.0/24