CVE-2024-21357: Windows 10 1507 PGM RCE Vulnerability

CVE-2024-21357 Overview

CVE-2024-21357 is a remote code execution vulnerability affecting the Windows Pragmatic General Multicast (PGM) protocol implementation. PGM is a reliable multicast transport protocol that enables receivers to detect loss, request retransmission of lost data, or notify an application of unrecoverable loss. This vulnerability allows remote attackers to execute arbitrary code on affected Windows systems by exploiting a type confusion weakness (CWE-843) in the PGM protocol handler.

The vulnerability exists in how Windows processes specially crafted PGM network packets. An attacker who successfully exploits this vulnerability could execute arbitrary code with SYSTEM-level privileges on the target system, potentially leading to complete system compromise.

Critical Impact

Remote attackers can achieve arbitrary code execution on vulnerable Windows systems through the network without requiring authentication or user interaction, though exploitation requires winning a race condition.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H1, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
• Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2

Discovery Timeline

• February 13, 2024 - CVE-2024-21357 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-21357

Vulnerability Analysis

This vulnerability is classified as a Type Confusion (CWE-843) issue within the Windows Pragmatic General Multicast implementation. Type confusion vulnerabilities occur when code allocates or initializes a resource such as a pointer, object, or variable using one type, but later accesses that resource using an incompatible type. In the context of the PGM protocol handler, this can lead to memory corruption when processing malformed multicast packets.

The attack can be initiated remotely over the network without requiring any privileges on the target system and without user interaction. However, successful exploitation requires the attacker to win a race condition, which adds complexity to weaponizing this vulnerability. Despite this constraint, the impact remains severe as successful exploitation grants the attacker full control over the affected system.

The PGM protocol is commonly used in scenarios requiring efficient multicast data distribution, such as financial market data feeds, multimedia streaming, and enterprise messaging systems. Systems running Message Queuing services with PGM enabled are particularly at risk.

Root Cause

The root cause of CVE-2024-21357 is a type confusion vulnerability in the Windows PGM protocol handler. The vulnerability stems from improper type handling when processing network packets, where the code fails to properly validate or enforce type safety before operating on memory objects. This allows an attacker to manipulate the type interpretation of data structures, leading to memory corruption that can be leveraged for code execution.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker can exploit this vulnerability by sending specially crafted PGM multicast packets to a vulnerable Windows system. The attack does not require authentication or user interaction, making it particularly dangerous for systems exposed to untrusted networks.

To exploit this vulnerability:

1. The attacker identifies a target system with PGM protocol support enabled
2. The attacker crafts malicious PGM packets designed to trigger the type confusion
3. These packets are transmitted over the network to the target
4. If the attacker successfully wins the race condition, arbitrary code executes with elevated privileges

The vulnerability requires the attacker to prepare the target environment in a specific way and then execute additional actions to exploit the flaw. Systems with the Message Queuing service running and PGM multicast enabled are the primary targets.

Detection Methods for CVE-2024-21357

Indicators of Compromise

• Anomalous PGM (Pragmatic General Multicast) network traffic patterns, particularly malformed or unexpected multicast packets
• Unexpected crashes or restarts of the Windows Message Queuing service (mqsvc.exe)
• Memory access violations or unusual error events in Windows Event logs related to network protocol handling
• Evidence of code execution from the Message Queuing service context

Detection Strategies

• Monitor network traffic for abnormal PGM protocol activity, especially from unexpected sources or with malformed packet structures
• Implement network-based intrusion detection rules to identify exploitation attempts targeting the PGM protocol
• Deploy endpoint detection and response (EDR) solutions capable of detecting memory corruption and type confusion exploitation patterns
• Enable enhanced logging on systems running Message Queuing services to capture anomalous behavior

Monitoring Recommendations

• Enable Windows Event logging for the Message Queuing service and review logs regularly for unusual activity
• Monitor for unexpected process creation or code execution originating from mqsvc.exe or related system processes
• Implement network segmentation to isolate systems that require PGM multicast functionality from untrusted network segments
• Use SentinelOne's Singularity platform to gain visibility into network-level attacks and memory-based exploitation attempts

How to Mitigate CVE-2024-21357

Immediate Actions Required

• Apply the Microsoft security update for CVE-2024-21357 from the February 2024 Patch Tuesday release immediately
• If patching is not immediately possible, disable the Windows Message Queuing service on systems where it is not required
• Restrict PGM multicast traffic at network boundaries using firewall rules to limit exposure
• Audit systems to identify which have the Message Queuing feature and PGM protocol enabled

Patch Information

Microsoft has released security updates to address CVE-2024-21357 as part of the February 2024 Patch Tuesday security updates. Organizations should apply the appropriate update for their Windows version as soon as possible. Detailed patch information is available in the Microsoft Security Update Guide.

The patches are available for all supported Windows versions including Windows 10, Windows 11, and Windows Server editions from 2008 through 2022 23H2.

Workarounds

• Disable the Message Queuing service if it is not required for business operations using Set-Service -Name MSMQ -StartupType Disabled
• Block PGM/multicast traffic at network firewalls for systems that do not require multicast functionality
• Implement network segmentation to isolate systems requiring PGM from general network access
• Enable Windows Firewall with advanced security rules to restrict inbound multicast traffic

# Disable Message Queuing service (if not required)
sc config MSMQ start= disabled
sc stop MSMQ

# Verify service status
sc query MSMQ