CVE-2023-35315: Windows 10 1809 Layer-2 Bridge RCE Flaw

CVE-2023-35315 Overview

CVE-2023-35315 is a remote code execution vulnerability affecting the Windows Layer-2 Bridge Network Driver. This driver is responsible for handling network bridging operations at the data link layer, enabling communication between different network segments. An attacker who successfully exploits this vulnerability can execute arbitrary code on affected systems from an adjacent network, potentially leading to complete system compromise.

Critical Impact

Successful exploitation allows an unauthenticated attacker on an adjacent network to execute arbitrary code with elevated privileges, potentially compromising confidentiality, integrity, and availability of affected Windows systems.

Affected Products

• Microsoft Windows 10 1809
• Microsoft Windows 10 21H2
• Microsoft Windows 10 22H2
• Microsoft Windows 11 21H2
• Microsoft Windows 11 22H2
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022

Discovery Timeline

• July 11, 2023 - CVE-2023-35315 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-35315

Vulnerability Analysis

This vulnerability exists within the Windows Layer-2 Bridge Network Driver, a kernel-mode component responsible for bridging network interfaces at the data link layer. The vulnerability is classified under CWE-190 (Integer Overflow), indicating that improper handling of integer arithmetic operations can lead to unexpected behavior and memory corruption.

The attack requires network adjacency, meaning the attacker must be on the same local network segment as the target system. However, no user interaction or authentication is required to exploit the vulnerability, making it particularly dangerous in enterprise environments where network bridging is commonly used for virtual machine networking, containerization, and network virtualization scenarios.

When successfully exploited, an attacker gains the ability to execute code at kernel level, potentially bypassing security boundaries and gaining complete control over the affected system. The impact spans all three security dimensions—confidentiality, integrity, and availability—as kernel-level access enables data theft, system modification, and denial of service.

Root Cause

The root cause of CVE-2023-35315 is an integer overflow vulnerability (CWE-190) within the Layer-2 Bridge Network Driver. Integer overflows occur when arithmetic operations produce results that exceed the maximum value that can be stored in the allocated integer type. In driver code, this can lead to undersized buffer allocations, which subsequently result in buffer overflows during data processing.

In the context of network driver operations, specially crafted network packets with manipulated size fields can trigger the integer overflow condition, causing the driver to allocate insufficient memory for packet processing. Subsequent write operations then overflow the allocated buffer, potentially overwriting adjacent kernel memory structures.

Attack Vector

The attack vector for CVE-2023-35315 requires the attacker to have access to an adjacent network. This means the attacker must be positioned on the same network segment as the target system—typically achieved through:

1. Physical network access - Being connected to the same LAN segment
2. Compromised adjacent host - Leveraging another compromised machine on the same network
3. Wireless network access - Joining the same wireless network as the target

From this position, the attacker can send malicious network traffic directly to the target system. The Layer-2 Bridge Network Driver processes this traffic at the kernel level, and specially crafted packets can trigger the integer overflow condition. Because the vulnerability requires no authentication and no user interaction, the attack can be launched silently against any system with the vulnerable driver active.

Systems running Hyper-V with virtual switches, Docker with bridged networking, or traditional network bridge configurations are particularly at risk as these scenarios actively utilize the Layer-2 Bridge Network Driver.

Detection Methods for CVE-2023-35315

Indicators of Compromise

• Unexpected kernel crashes or blue screens (BSOD) related to network driver components, particularly l2bridge.sys or associated bridge networking modules
• Anomalous network traffic patterns originating from adjacent network segments with malformed packet structures
• System event logs showing driver exceptions or memory access violations in network driver contexts
• Unexpected process creation or code execution following network driver activity

Detection Strategies

• Deploy network intrusion detection systems (NIDS) configured to identify anomalous Layer-2 traffic patterns and malformed Ethernet frames
• Monitor Windows event logs for kernel driver crashes and memory violation events, specifically Event ID 1001 (BugCheck) entries
• Implement SentinelOne's behavioral AI engine to detect kernel-level exploitation attempts and anomalous driver behavior
• Enable kernel auditing and driver verification features to detect unauthorized memory operations

Monitoring Recommendations

• Configure continuous monitoring of systems with active network bridging configurations, including Hyper-V hosts and container platforms
• Establish baseline network traffic patterns and alert on deviations in Layer-2 traffic characteristics
• Monitor patch compliance across all affected Windows versions to identify unpatched systems
• Deploy SentinelOne Singularity platform for real-time kernel-level threat detection and automated response capabilities

How to Mitigate CVE-2023-35315

Immediate Actions Required

• Apply Microsoft's security update for CVE-2023-35315 immediately on all affected systems
• Prioritize patching on systems actively using network bridging features, including Hyper-V hosts, Docker hosts, and network appliances
• Implement network segmentation to limit attacker access to adjacent network positions
• Disable the Layer-2 Bridge Network Driver on systems where network bridging is not required

Patch Information

Microsoft has released security updates addressing CVE-2023-35315 as part of their July 2023 Patch Tuesday release cycle. The patch corrects the integer overflow condition in the Layer-2 Bridge Network Driver by implementing proper bounds checking on arithmetic operations during packet processing.

Administrators should consult the Microsoft Security Update Guide for CVE-2023-35315 for specific patch versions and deployment guidance. The update is available through Windows Update, Windows Server Update Services (WSUS), and the Microsoft Update Catalog.

Workarounds

• Disable the Layer-2 Bridge Network Driver component on systems where network bridging functionality is not actively required
• Implement strict network access controls to limit which devices can communicate on adjacent network segments
• Deploy network-level filtering to inspect and drop malformed Layer-2 traffic before it reaches potentially vulnerable systems
• Consider using alternative virtualization networking configurations that do not rely on the bridge driver where feasible

# Check if Layer-2 Bridge Network Driver is in use
Get-NetAdapter | Where-Object { $_.InterfaceDescription -like "*Bridge*" }

# Disable network bridge adapter if not needed (PowerShell - Run as Administrator)
Disable-NetAdapter -Name "Network Bridge" -Confirm:$false

# Verify Windows Update status for security patches
Get-HotFix | Where-Object { $_.Description -eq "Security Update" } | Sort-Object InstalledOn -Descending