CVE-2023-38043: Ivanti Secure Access Client DoS Vulnerability

CVE-2023-38043 Overview

CVE-2023-38043 affects all versions of the Ivanti Secure Access Client below 22.6R1.1 on Microsoft Windows. A locally authenticated attacker can exploit a vulnerable configuration to trigger a denial of service (DoS) condition on the user machine. In some cases, exploitation can result in full system compromise.

The issue is tracked under [CWE-400] (Uncontrolled Resource Consumption) and was disclosed by Northwave Cyber Security as an arbitrary kernel function call in the Ivanti Secure Access Client. Ivanti addressed the flaw in version 22.6R1.1 of the Secure Access Client.

Critical Impact
Successful exploitation can crash the host or yield kernel-level code execution, granting attackers full control of the affected Windows endpoint.

Affected Products

Ivanti Secure Access Client versions prior to 22.6R1.1
Ivanti Secure Access Client 22.6:r1
Microsoft Windows (host operating system)

Discovery Timeline

2023-11-15 - CVE-2023-38043 published to the National Vulnerability Database (NVD)
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-38043

Vulnerability Analysis

The vulnerability resides in the Ivanti Secure Access Client for Windows, a VPN client that installs a kernel-mode driver to provide secure network connectivity. According to the Northwave advisory, the flaw enables an arbitrary kernel function call through the client's driver interface.

A locally authenticated user can interact with the vulnerable driver through its exposed I/O control interface. Insufficient validation of caller-supplied parameters allows the attacker to direct the driver to invoke kernel functions with attacker-controlled arguments. The result is either an immediate system crash (DoS) or, when arguments are crafted carefully, escalation from a standard user to SYSTEM-level privileges.

Root Cause

The root cause is improper validation of input passed from user mode to the Ivanti kernel driver. The driver accepts a function pointer or dispatch index from a low-privilege caller and executes it in kernel context without sufficient access checks. This design weakness is categorized under [CWE-400] in the NVD record, with the secondary classification being arbitrary kernel function invocation.

Attack Vector

Exploitation requires local access and low privileges. No user interaction is required beyond the attacker running code on the target machine. Because the affected component runs in kernel space, successful exploitation breaks the user-to-kernel security boundary on Windows.

No public proof-of-concept code has been released, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. For technical specifics of the kernel call primitive, refer to the Northwave Vulnerability Notice.

Detection Methods for CVE-2023-38043

Indicators of Compromise

Unexpected bug checks (BSOD) on hosts running Ivanti Secure Access Client below 22.6R1.1, particularly with stop codes referencing the Ivanti driver.
Unauthorized processes spawning under NT AUTHORITY\SYSTEM shortly after user-context activity involving the Ivanti client.
New or modified services and scheduled tasks created immediately following Ivanti Secure Access Client driver interactions.

Detection Strategies

Inventory all Windows endpoints and identify any Ivanti Secure Access Client installation with a version below 22.6R1.1.
Monitor for non-Ivanti user-mode processes opening handles to the Ivanti kernel driver device object.
Hunt for privilege escalation patterns where a standard user process is followed by SYSTEM-level child processes on hosts with the vulnerable client.

Monitoring Recommendations

Enable Windows kernel and driver load auditing to track interactions with the Ivanti Secure Access Client driver.
Forward endpoint telemetry to a centralized analytics platform and alert on kernel crashes correlated with VPN client activity.
Review authentication and process-creation logs for anomalous SYSTEM-context activity on workstations using the Ivanti VPN client.

How to Mitigate CVE-2023-38043

Immediate Actions Required

Upgrade Ivanti Secure Access Client to version 22.6R1.1 or later on every Windows endpoint.
Audit installed software across the fleet to identify legacy or shadow installations of the Ivanti client.
Restrict local user accounts on endpoints to limit which users can interact with the vulnerable driver until patching is complete.

Patch Information

Ivanti has released a fixed version of the Secure Access Client. Apply 22.6R1.1 or later as documented in the Ivanti Security Fixes Release. Validate the deployed version on each host after upgrade to confirm remediation.

Workarounds

No vendor-supplied workaround replaces the patch; upgrading is the only complete remediation.
Where immediate patching is not feasible, reduce exposure by removing local administrative rights and enforcing application allowlisting to block untrusted code from running on affected endpoints.
Temporarily uninstall the Ivanti Secure Access Client on systems where it is not actively required for VPN connectivity.

bash

# Verify the installed Ivanti Secure Access Client version on Windows (PowerShell)
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Ivanti Secure Access*" } | Select-Object Name, Version

# Expected output: Version 22.6R1.1 or later