CVE-2022-35804: Microsoft Windows 11 SMB RCE Vulnerability

CVE-2022-35804 Overview

CVE-2022-35804 is a remote code execution vulnerability affecting the SMB (Server Message Block) Client and Server components in Microsoft Windows 11. This network-accessible vulnerability allows attackers to execute arbitrary code on vulnerable systems, potentially leading to complete system compromise. The vulnerability requires user interaction but can be exploited remotely without authentication, making it a significant threat to enterprise environments utilizing SMB file sharing protocols.

Critical Impact

Successful exploitation enables remote code execution with the potential for complete system compromise, data exfiltration, lateral movement across networks, and ransomware deployment.

Affected Products

• Microsoft Windows 11 (x64)
• Microsoft Windows 11 (ARM64)

Discovery Timeline

• 2022-08-09 - CVE CVE-2022-35804 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-35804

Vulnerability Analysis

This vulnerability resides in the SMB Client and Server implementation within Windows 11. SMB is a network file sharing protocol that allows applications to read and write files and request services from server programs in a computer network. The vulnerability affects both the client-side and server-side components, creating multiple attack surfaces.

The flaw can be exploited remotely over the network with low attack complexity. While no prior authentication is required to attempt exploitation, user interaction is necessary for a successful attack. This typically manifests as requiring a user to connect to a malicious SMB server or interact with a specially crafted SMB request.

Upon successful exploitation, an attacker can achieve high impacts to confidentiality, integrity, and availability—effectively gaining control over the target system. This could enable attackers to execute arbitrary code in the context of the affected process, potentially escalating to full system access.

Root Cause

The specific technical root cause has not been publicly disclosed by Microsoft (classified as NVD-CWE-noinfo). However, based on the vulnerability class and SMB protocol complexity, the flaw likely involves improper handling of SMB protocol messages, potentially including buffer management issues, insufficient validation of protocol-specific fields, or improper state handling during SMB session negotiation and data transfer operations.

Attack Vector

The attack vector is network-based, allowing remote exploitation. An attacker could exploit this vulnerability through several methods:

On the server-side: An attacker could send specially crafted SMB packets to a vulnerable Windows 11 system with SMB services enabled, triggering the vulnerability when the malformed packets are processed.

On the client-side: An attacker could host a malicious SMB server and entice a user to connect to it, such as through phishing emails containing UNC paths, malicious links in documents, or through network-level attacks that redirect SMB traffic.

The requirement for user interaction on the client-side creates opportunities for social engineering attacks where users are tricked into clicking links or accessing resources that connect to attacker-controlled infrastructure.

Detection Methods for CVE-2022-35804

Indicators of Compromise

• Unusual outbound SMB connections to external or unfamiliar IP addresses
• Unexpected SMB server processes or services on non-server endpoints
• Anomalous network traffic patterns on ports 445 and 139
• Crash reports or unexpected terminations of SMB-related services

Detection Strategies

• Monitor SMB traffic for malformed packet structures or unusual protocol sequences
• Deploy network intrusion detection signatures for known SMB exploitation patterns
• Enable Windows Event logging for SMB-related events (Event IDs 551, 552 for SMB session events)
• Implement endpoint detection rules for anomalous process behavior following SMB activity

Monitoring Recommendations

• Configure SentinelOne agents to monitor SMB protocol activity and process execution chains
• Establish baseline metrics for SMB traffic volume and connection patterns within the environment
• Alert on SMB connections to non-trusted or external destinations from Windows 11 workstations
• Review logs for failed SMB authentication attempts that may indicate reconnaissance

How to Mitigate CVE-2022-35804

Immediate Actions Required

• Apply the August 2022 Microsoft security updates to all affected Windows 11 systems immediately
• Restrict SMB traffic at network perimeters by blocking ports 445 and 139 from untrusted networks
• Disable SMBv1 if still enabled, as older protocol versions often have additional vulnerabilities
• Implement network segmentation to limit SMB traffic scope and potential lateral movement

Patch Information

Microsoft has released security patches addressing CVE-2022-35804 as part of the August 2022 Patch Tuesday updates. System administrators should consult the Microsoft CVE-2022-35804 Advisory for detailed patch information and download links. The patches should be deployed to all Windows 11 systems (both x64 and ARM64 architectures) through Windows Update, WSUS, or enterprise patch management solutions.

Workarounds

• Block outbound SMB connections (port 445) at the firewall for systems that do not require external SMB access
• Disable the SMB Server service on workstations that do not need to share files via SMB
• Implement strict network access controls to limit SMB communications to known, trusted internal servers only
• Use VPN or other secure tunneling for any legitimate remote SMB access requirements

# Disable SMB Server service on Windows 11 workstations
# Run PowerShell as Administrator
Set-Service -Name "LanmanServer" -StartupType Disabled
Stop-Service -Name "LanmanServer" -Force

# Verify SMB Server is disabled
Get-Service -Name "LanmanServer"

# Block outbound SMB via Windows Firewall
New-NetFirewallRule -DisplayName "Block Outbound SMB" -Direction Outbound -LocalPort 445 -Protocol TCP -Action Block