CVE-2024-21342 Overview
CVE-2024-21342 is a denial of service vulnerability in the Windows DNS Client component. Microsoft published the advisory on February 13, 2024, affecting Windows 11 and Windows Server 2022 platforms. The flaw allows a network-based attacker to disrupt DNS resolution services on affected hosts without authentication or user interaction. The vulnerability is categorized under [CWE-400] Uncontrolled Resource Consumption, indicating that crafted DNS traffic can exhaust client-side resources. Successful exploitation degrades or halts name resolution, which cascades into broader application and service outages on the target system.
Critical Impact
An unauthenticated remote attacker can trigger a denial of service condition in the Windows DNS Client, disrupting name resolution and dependent services on affected Windows 11 and Windows Server 2022 systems.
Affected Products
- Microsoft Windows 11 22H2
- Microsoft Windows 11 23H2
- Microsoft Windows Server 2022 23H2
Discovery Timeline
- 2024-02-13 - CVE-2024-21342 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-21342
Vulnerability Analysis
The vulnerability resides in the Windows DNS Client, the component responsible for issuing and processing DNS queries on behalf of local applications. An attacker positioned on the network can send crafted DNS responses or related traffic that causes the client to consume excessive resources. The condition maps to [CWE-400] Uncontrolled Resource Consumption, a category covering flaws where input handling does not enforce appropriate bounds on memory, CPU, or other finite resources.
Microsoft classifies the impact as availability-only, meaning confidentiality and integrity of data are not directly affected. However, DNS is foundational to nearly every networked workload. When the client stops resolving names, dependent services such as Active Directory authentication, web browsing, software updates, and outbound API calls fail. The EPSS score of 8.389% places this CVE in the 92nd percentile for likelihood of exploitation activity.
Root Cause
The root cause is improper handling of certain DNS protocol inputs within the client resolver code path. The implementation does not adequately throttle or validate resource usage when processing attacker-influenced responses, allowing a remote party to exhaust client capacity. Microsoft has not released detailed technical analysis of the specific code path beyond the advisory.
Attack Vector
The attack vector is network-based with low complexity, no privileges, and no user interaction required. An attacker capable of delivering DNS traffic to the target system, including off-path attackers leveraging spoofed responses or attacker-controlled resolvers, can trigger the condition. Refer to the Microsoft CVE-2024-21342 Advisory for vendor guidance.
No public proof-of-concept exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of this writing.
Detection Methods for CVE-2024-21342
Indicators of Compromise
- Sudden failures of DNS resolution on Windows 11 or Windows Server 2022 hosts, particularly correlating with bursts of inbound DNS traffic.
- dnscache service instability, crashes, or repeated restarts recorded in the Windows System event log.
- Elevated CPU or memory consumption attributable to the DNS Client service without a corresponding legitimate workload.
Detection Strategies
- Monitor Windows event logs for dnscache service termination, restart events, and DNS resolution error patterns across endpoints.
- Inspect network telemetry for anomalous volumes of inbound DNS response traffic to client systems, especially unsolicited responses.
- Baseline normal DNS query and response patterns per host and alert on statistically significant deviations.
Monitoring Recommendations
- Forward DNS Client operational logs and System event logs to a centralized SIEM for correlation across the fleet.
- Track patch deployment status for Windows 11 22H2, 23H2, and Windows Server 2022 23H2 to identify unpatched assets.
- Alert on application-layer failures that correlate with DNS resolution errors to surface downstream impact.
How to Mitigate CVE-2024-21342
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2024-21342 Advisory to all affected Windows 11 22H2, 23H2, and Windows Server 2022 23H2 systems.
- Prioritize patching for domain controllers, internet-facing servers, and systems that other services depend on for name resolution.
- Validate that the dnscache service returns to a healthy state after patch installation and reboot.
Patch Information
Microsoft addressed CVE-2024-21342 in the February 2024 security update cycle. Consult the Microsoft CVE-2024-21342 Advisory for the specific KB article numbers corresponding to each affected Windows build and apply via Windows Update, WSUS, or your preferred patch management workflow.
Workarounds
- Restrict inbound DNS traffic to client systems using host-based and perimeter firewall rules that permit responses only from trusted resolvers.
- Configure endpoints to use internal, controlled DNS servers and block direct DNS traffic to external resolvers where operationally feasible.
- Deploy DNS query monitoring to detect and rate-limit abnormal response volumes targeting client hosts until patches are applied.
# Example: Restrict inbound DNS responses to trusted resolvers on Windows
New-NetFirewallRule -DisplayName "Allow DNS from Internal Resolver" `
-Direction Inbound -Protocol UDP -LocalPort 53 `
-RemoteAddress 10.0.0.53 -Action Allow
New-NetFirewallRule -DisplayName "Block Untrusted DNS Responses" `
-Direction Inbound -Protocol UDP -LocalPort 53 `
-Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
