CVE-2022-35804 Overview
CVE-2022-35804 is a remote code execution vulnerability affecting both the Server Message Block (SMB) client and server components in Microsoft Windows 11. Attackers can exploit the flaw over the network to execute arbitrary code on vulnerable systems. The issue impacts Windows 11 builds on both x64 and arm64 architectures.
Microsoft published advisory information for this issue through the Microsoft Security Response Center. The vulnerability requires user interaction during exploitation, but no privileges or prior authentication are needed to initiate the attack. EPSS data places this vulnerability in the 94th percentile for likelihood of exploitation.
Critical Impact
Successful exploitation grants remote code execution on Windows 11 systems through the SMB stack, compromising confidentiality, integrity, and availability.
Affected Products
- Microsoft Windows 11 (x64)
- Microsoft Windows 11 (arm64)
- Systems running SMB client or server roles on Windows 11
Discovery Timeline
- 2022-08-09 - CVE-2022-35804 published to the National Vulnerability Database
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2022-35804
Vulnerability Analysis
The vulnerability resides in the SMB protocol implementation shipped with Windows 11. SMB handles file sharing, printer access, and inter-process communication across networks. The flaw affects both client and server roles, meaning a malicious server can target a client and a malicious client can target a server.
Microsoft classifies this issue as a remote code execution vulnerability. The CWE assignment is NVD-CWE-noinfo because Microsoft did not publish granular root-cause details. Based on the attack profile, the issue is consistent with memory corruption during SMB message processing. Refer to the Microsoft Vulnerability Advisory for vendor-confirmed technical scope.
Root Cause
Microsoft did not publicly disclose specific root-cause details. The vendor advisory documents the issue as a memory-handling defect within the SMB stack that allows an attacker-controlled payload to influence execution flow. Both the SMB client and server share affected code paths.
Attack Vector
Exploitation occurs over the network. An attacker can host a crafted SMB server and induce a victim to connect to it, or send crafted SMB traffic to a system exposing the SMB service. User interaction is required, typically by convincing a user to access a malicious share. No authentication is required to deliver the malicious payload. Successful exploitation yields code execution in the context of the SMB process.
No public proof-of-concept exploit is currently published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2022-35804
Indicators of Compromise
- Unexpected outbound SMB (TCP/445) connections from workstations to untrusted external hosts.
- Anomalous child processes spawned by SMB-related services such as srv2.sys activity or LanmanServer host processes.
- Crashes or unexpected restarts of SMB services correlated with crafted inbound packets.
Detection Strategies
- Inspect SMB traffic for malformed message structures and oversized fields that deviate from protocol specifications.
- Correlate SMB session establishment with subsequent process creation events on the endpoint to identify post-exploitation behavior.
- Hunt for unusual SMB client connections originating from user workstations to unknown public IP addresses, which can indicate phishing-driven exploitation.
Monitoring Recommendations
- Enable Windows audit policies for SMB session activity and forward logs to a centralized SIEM or data lake.
- Monitor egress firewall logs for TCP/445 and TCP/139 traffic leaving the corporate perimeter.
- Track patch deployment status across the Windows 11 fleet using endpoint management tooling to identify unpatched assets.
How to Mitigate CVE-2022-35804
Immediate Actions Required
- Apply the August 2022 Microsoft security updates for Windows 11 to all affected x64 and arm64 systems.
- Block outbound TCP/445 at the network perimeter to prevent users from connecting to attacker-controlled SMB servers.
- Restrict inbound SMB exposure on internal hosts to only required management segments.
Patch Information
Microsoft released a security update addressing CVE-2022-35804 as part of the August 2022 Patch Tuesday cycle. Patch details and downloadable updates are available through the Microsoft Vulnerability Advisory. Administrators should validate deployment through Windows Update for Business, WSUS, or equivalent patch management infrastructure.
Workarounds
- Disable the SMB client service on endpoints that do not require remote file share access.
- Disable the SMB server service on workstations not hosting shared resources.
- Enforce SMB signing and require SMB 3.1.1 with encryption to reduce exposure on segments where the protocol is required.
# Disable SMB server on a Windows 11 host (PowerShell, run as Administrator)
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Set-Service -Name LanmanServer -StartupType Disabled
Stop-Service -Name LanmanServer -Force
# Block outbound SMB at the host firewall
New-NetFirewallRule -DisplayName "Block Outbound SMB 445" -Direction Outbound `
-Protocol TCP -RemotePort 445 -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
