CVE-2022-35744 Overview
CVE-2022-35744 is a critical Remote Code Execution (RCE) vulnerability affecting the Windows Point-to-Point Protocol (PPP) implementation across a wide range of Microsoft Windows operating systems. This vulnerability allows unauthenticated remote attackers to execute arbitrary code on vulnerable systems by sending specially crafted PPP protocol packets over the network.
The Point-to-Point Protocol is a data link layer protocol used to establish direct connections between two networking nodes, commonly utilized for dial-up connections, VPN tunneling, and broadband connections. The vulnerability resides in how Windows processes PPP packets, enabling attackers to compromise systems without requiring any user interaction or authentication.
Critical Impact
Unauthenticated remote attackers can execute arbitrary code with SYSTEM-level privileges on vulnerable Windows systems, potentially leading to complete system compromise, data theft, lateral movement, and ransomware deployment across enterprise networks.
Affected Products
- Microsoft Windows 7 SP1
- Microsoft Windows 8.1
- Microsoft Windows 10 (versions 1507, 1607, 1809, 20H2, 21H1)
- Microsoft Windows 11 21H2
- Microsoft Windows RT 8.1
- Microsoft Windows Server 2008 SP2 and R2 SP1
- Microsoft Windows Server 2012 and R2
- Microsoft Windows Server 2016
- Microsoft Windows Server 2019
- Microsoft Windows Server 2022
- Microsoft Windows Server 20H2
Discovery Timeline
- May 31, 2023 - CVE-2022-35744 published to NVD
- November 21, 2024 - Last updated in NVD database
Technical Details for CVE-2022-35744
Vulnerability Analysis
This vulnerability affects the Windows Point-to-Point Protocol implementation, specifically within the Remote Access Service (RAS) component. The PPP protocol is responsible for encapsulating network layer protocol information over point-to-point links, and the vulnerable code path can be triggered when processing malformed PPP packets.
The vulnerability can be exploited remotely over the network without requiring authentication or user interaction, making it particularly dangerous for internet-facing systems running RAS services or systems configured as VPN endpoints. Successful exploitation grants the attacker the ability to execute arbitrary code with elevated privileges, typically SYSTEM-level access.
Organizations running Routing and Remote Access Service (RRAS) are at heightened risk, as the attack surface is exposed to remote network connections. The vulnerability affects both x86, x64, and ARM64 architectures across the supported Windows versions.
Root Cause
The root cause of CVE-2022-35744 lies in improper handling of PPP protocol packets within the Windows networking stack. While Microsoft has not disclosed specific technical details to prevent exploitation, the vulnerability class suggests potential issues with input validation, buffer boundary checking, or memory management when parsing PPP protocol data structures.
The Windows RAS server component processes incoming PPP negotiation packets, and malformed or specially crafted packets can trigger the vulnerability in systems with the Remote Access role enabled or those configured to accept incoming PPP connections.
Attack Vector
The attack vector is network-based, requiring the attacker to send specially crafted PPP packets to a vulnerable Windows system. The attack scenario involves:
- Target Identification: Attacker identifies systems running Windows RAS services or accepting PPP connections
- Packet Crafting: Malicious PPP packets are constructed to trigger the vulnerability
- Remote Transmission: The crafted packets are sent to the target system over the network
- Code Execution: Upon processing the malicious packets, arbitrary code executes with SYSTEM privileges
The vulnerability requires no authentication and no user interaction, allowing for fully automated exploitation. Systems with Routing and Remote Access Service enabled, VPN servers, and dial-up access points are primary targets.
Detection Methods for CVE-2022-35744
Indicators of Compromise
- Unexpected crashes or restarts of the Remote Access Service (rasman.dll, rastapi.dll)
- Anomalous PPP protocol traffic on ports used for VPN connections (TCP/1723 for PPTP)
- Suspicious process creation from svchost.exe hosting RAS services
- Unusual network connections from RAS-related processes to external IP addresses
Detection Strategies
- Monitor for malformed or unusually large PPP protocol packets targeting Windows systems
- Implement network intrusion detection rules for anomalous PPP protocol behavior
- Deploy endpoint detection solutions capable of monitoring RAS service behavior and memory anomalies
- Analyze Windows Event Logs for RAS service errors, crashes, or unexpected restarts
Monitoring Recommendations
- Enable detailed logging for Remote Access Service events in Windows Event Viewer
- Configure SIEM rules to alert on RAS service anomalies and potential exploitation attempts
- Monitor network traffic for PPP protocol anomalies at network perimeter
- Implement behavioral monitoring for processes spawned by RAS service components
How to Mitigate CVE-2022-35744
Immediate Actions Required
- Apply the Microsoft security update immediately to all affected Windows systems
- Disable Routing and Remote Access Service (RRAS) if not required for business operations
- Implement network segmentation to restrict access to RAS servers from untrusted networks
- Review and harden firewall rules to limit exposure of PPP/VPN services to trusted networks only
Patch Information
Microsoft has released security updates to address CVE-2022-35744 for all affected Windows versions. Organizations should prioritize patching systems running Remote Access Service or VPN services, as these are the primary attack vectors.
Detailed patch information and download links are available from the Microsoft Security Update Guide. Security updates should be applied through Windows Update, Windows Server Update Services (WSUS), or manual installation from the Microsoft Update Catalog.
Workarounds
- Disable the Routing and Remote Access Service if VPN functionality is not required
- Block PPP-related traffic at network perimeters using firewall rules
- Implement IP allowlisting for systems that must maintain RAS services
- Consider migrating to alternative VPN solutions such as IKEv2/IPsec or third-party VPN software until patching is complete
# Disable Routing and Remote Access Service (if not required)
Stop-Service -Name RemoteAccess -Force
Set-Service -Name RemoteAccess -StartupType Disabled
# Verify service is disabled
Get-Service -Name RemoteAccess | Select-Object Name, Status, StartType
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
