CVE-2023-36397: Windows 10 1507 PGM RCE Vulnerability

CVE-2023-36397 Overview

CVE-2023-36397 is a remote code execution vulnerability in the Windows Pragmatic General Multicast (PGM) protocol implementation. The flaw affects the Windows Message Queuing (MSMQ) service when configured to use PGM for multicast message delivery. An unauthenticated attacker can send specially crafted network traffic to a vulnerable host and execute arbitrary code in the context of the service. The vulnerability is classified as [CWE-126] Buffer Over-read and carries a CVSS 3.1 base score of 9.8. Microsoft addressed the issue in the November 2023 security updates across all supported Windows client and server releases.

Critical Impact
Unauthenticated remote attackers can achieve code execution over the network without user interaction when Windows Message Queuing is installed and the PGM transport is enabled.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (21H2, 22H2, 23H2)
Microsoft Windows Server 2008, 2012, 2012 R2, 2016, 2019, and 2022

Discovery Timeline

2023-11-14 - CVE-2023-36397 published to NVD
2023-11-14 - Microsoft releases security patch as part of November 2023 Patch Tuesday
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36397

Vulnerability Analysis

The vulnerability resides in the Windows implementation of the Pragmatic General Multicast (PGM) protocol, a reliable multicast transport layered on top of IP multicast. PGM is exposed through the Windows Message Queuing (MSMQ) service, which optionally uses PGM for multicast publish-subscribe messaging. The flaw is a buffer over-read condition ([CWE-126]) in the parsing of PGM packets. When a malformed packet is processed, the service reads beyond the bounds of an allocated buffer, enabling memory corruption that can be leveraged for arbitrary code execution.

Exploitation requires no authentication and no user interaction. The attack vector is the network, and the affected component runs with elevated privileges, resulting in full compromise of confidentiality, integrity, and availability on the target host.

Root Cause

The root cause is improper bounds checking in the PGM packet parsing logic within the Windows networking stack. Length fields within PGM headers are not validated against the actual size of the received datagram before memory accesses occur, allowing crafted packets to trigger out-of-bounds reads that overlap into adjacent memory structures.

Attack Vector

An attacker reaches a vulnerable host by sending crafted PGM packets to a system running MSMQ with the multicast transport enabled. MSMQ listens on TCP port 1801 and uses PGM for multicast delivery. Because PGM is a network protocol, exploitation can occur across routed segments wherever multicast traffic or directed PGM datagrams reach the target. The Microsoft Security Response Center advisory for CVE-2023-36397 provides patch details and configuration guidance.

Detection Methods for CVE-2023-36397

Indicators of Compromise

Unexpected PGM traffic (IP protocol 113) directed at hosts running the Message Queuing service
Crashes or unexpected restarts of the mqsvc.exe Message Queuing service process
New child processes spawned by mqsvc.exe or unusual outbound connections from the MSMQ service account
Unexplained listener activity on TCP port 1801 from previously dormant hosts

Detection Strategies

Inventory all systems where the Message Queuing (MSMQ) feature is installed and flag those running unpatched builds
Inspect network telemetry for IP protocol 113 traffic outside of authorized multicast publishers and subscribers
Correlate service crash events (Event ID 7031, 7034) for MSMQ with subsequent process creation anomalies

Monitoring Recommendations

Forward Windows Security, System, and Sysmon logs from MSMQ-enabled hosts to a centralized analytics platform
Alert on process creation where the parent is mqsvc.exe and the child is a shell, scripting host, or LOLBin
Monitor firewall and NetFlow data for unsolicited PGM datagrams from untrusted network zones

How to Mitigate CVE-2023-36397

Immediate Actions Required

Apply the November 2023 Microsoft security updates to all affected Windows client and server builds
Audit systems for the Message Queuing role and remove it from hosts that do not require MSMQ functionality
Block inbound TCP port 1801 and PGM (IP protocol 113) at perimeter and internal segmentation firewalls
Restrict MSMQ multicast publishers and subscribers to dedicated VLANs with explicit allow-lists

Patch Information

Microsoft released fixes for CVE-2023-36397 on November 14, 2023 as part of the monthly cumulative updates for Windows 10, Windows 11, and Windows Server 2008 through 2022. Refer to the Microsoft Security Update Guide for CVE-2023-36397 for the specific KB article matching each Windows build.

Workarounds

Disable the Windows Message Queuing service (MSMQ) on hosts that do not require it: sc stop MSMQ followed by sc config MSMQ start= disabled
Uninstall the Message Queuing Windows feature entirely where it is not in use
Block TCP port 1801 and IP protocol 113 (PGM) at host and network firewalls until patches can be applied

bash

# Configuration example: disable MSMQ and block PGM traffic on Windows
sc.exe stop MSMQ
sc.exe config MSMQ start= disabled

# Block MSMQ TCP listener
netsh advfirewall firewall add rule name="Block MSMQ 1801" dir=in action=block protocol=TCP localport=1801

# Block inbound PGM (IP protocol 113)
netsh advfirewall firewall add rule name="Block PGM Protocol 113" dir=in action=block protocol=113