CVE-2023-21758: Windows 10 IKE Extension DoS Vulnerability

CVE-2023-21758 Overview

CVE-2023-21758 is a denial of service vulnerability in the Windows Internet Key Exchange (IKE) Extension. The flaw affects multiple supported versions of Windows 10, Windows 11, and Windows Server. Microsoft published the advisory on January 10, 2023 as part of its monthly security update cycle.

The vulnerability is rooted in a NULL pointer dereference [CWE-476] inside the IKE protocol handler. A remote, unauthenticated attacker can send specially crafted IKE traffic to a vulnerable host to trigger the condition. Successful exploitation disrupts availability of the targeted system without requiring user interaction.

Critical Impact
Network-reachable Windows hosts running the IKE extension can be forced into a denial of service state by unauthenticated remote traffic, with an EPSS probability of 49.68% (97.836 percentile).

Affected Products

Microsoft Windows 10 (1607, 1809, 20H2, 21H2, 22H2)
Microsoft Windows 11 (21H2, 22H2 — x64 and ARM64)
Microsoft Windows Server 2016, 2019, and 2022

Discovery Timeline

2023-01-10 - CVE-2023-21758 published to NVD
2023-01-10 - Microsoft releases security patch via January 2023 Patch Tuesday
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-21758

Vulnerability Analysis

The Windows IKE Extension implements the Internet Key Exchange protocol used by IPsec to negotiate security associations. The component processes inbound IKE messages on UDP ports 500 and 4500. CVE-2023-21758 represents a denial of service condition reachable through this network-facing protocol stack.

The vulnerability is classified under [CWE-476] NULL Pointer Dereference. When the IKE extension parses a malformed or unexpected protocol message, code paths fail to validate a pointer before dereferencing it. The resulting fault terminates the affected service or causes a system crash, breaking IPsec-dependent connectivity.

Microsoft assesses the issue as network-exploitable with no privileges and no user interaction required. The impact is limited to availability — confidentiality and integrity are not affected. Hosts that expose IKE to untrusted networks, including VPN gateways and Always On VPN servers, carry the highest exposure.

Root Cause

The defect resides in message parsing logic within the IKE extension. A pointer derived from attacker-controlled protocol fields is used without a prior validity check, leading to a NULL dereference under crafted input. Microsoft did not release detailed root cause analysis in the public advisory.

Attack Vector

An unauthenticated attacker sends one or more crafted IKE packets to UDP/500 or UDP/4500 on a target running the IKE extension. No prior session, credentials, or victim interaction is needed. The malformed payload steers the parser into the vulnerable code path and triggers the dereference, halting IKE processing or the host.

No public exploit, proof-of-concept, or CISA KEV listing has been published for this CVE. Refer to the Microsoft Security Update CVE-2023-21758 advisory for vendor-provided details.

Detection Methods for CVE-2023-21758

Indicators of Compromise

Unexpected termination or repeated restarts of the IKE and AuthIP Keying Modules service (IKEEXT) on Windows hosts.
Bursts of malformed or oversized ISAKMP packets to UDP/500 or UDP/4500 from untrusted sources.
IPsec tunnels dropping simultaneously across multiple peers without configuration changes.
Windows Event Log entries from IKEEXT source indicating parsing failures or service faults.

Detection Strategies

Monitor for crashes of the IKEEXT service and correlate with inbound IKE traffic volume and source addresses.
Inspect ISAKMP traffic at the network perimeter for protocol violations, malformed headers, or anomalous payload sizes.
Alert on repeated IPsec security association establishment failures originating from the same external source.

Monitoring Recommendations

Forward Windows System and Application logs from VPN servers and domain-joined hosts to a centralized SIEM for IKEEXT fault tracking.
Track UDP/500 and UDP/4500 connection rates from external networks and baseline normal volume to detect anomalous spikes.
Enable IPsec auditing through Group Policy to capture authentication and negotiation events tied to suspect peers.

How to Mitigate CVE-2023-21758

Immediate Actions Required

Apply the January 2023 Microsoft security update to all affected Windows 10, Windows 11, and Windows Server systems.
Prioritize patching for internet-facing VPN gateways, RAS servers, and Always On VPN infrastructure that expose IKE.
Inventory hosts running the IKEEXT service to confirm patch coverage across the environment.

Patch Information

Microsoft released fixes for CVE-2023-21758 on January 10, 2023. Patch identifiers per affected build are listed in the Microsoft Security Update CVE-2023-21758 advisory. Install the cumulative update that corresponds to each Windows version through Windows Update, WSUS, or your preferred patch management workflow.

Workarounds

Restrict UDP/500 and UDP/4500 inbound access to known IPsec peers using host or perimeter firewall rules.
Disable the IKEEXT service on hosts that do not require IPsec or IKE-based VPN connectivity until patching completes.
Place VPN endpoints behind network filtering that drops malformed ISAKMP packets before they reach the IKE parser.

bash

# Example: restrict IKE traffic to a known peer using Windows Firewall
New-NetFirewallRule -DisplayName "IKE-Allow-Known-Peer" -Direction Inbound -Protocol UDP -LocalPort 500,4500 -RemoteAddress 203.0.113.10 -Action Allow
New-NetFirewallRule -DisplayName "IKE-Block-Other" -Direction Inbound -Protocol UDP -LocalPort 500,4500 -Action Block