CVE-2024-28915: OLE DB Driver for SQL Server RCE Flaw

CVE-2024-28915 Overview

CVE-2024-28915 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw is categorized as a heap-based buffer overflow [CWE-122] and affects deployments that include the OLE DB Driver bundled with Microsoft SQL Server 2019 and SQL Server 2022. An attacker can trigger the condition when a client application using the vulnerable driver connects to an attacker-controlled SQL Server instance. Successful exploitation can lead to arbitrary code execution in the context of the client process.

Critical Impact
Successful exploitation enables remote code execution on systems running the vulnerable OLE DB Driver after a user-initiated connection to a malicious SQL Server endpoint.

Affected Products

Microsoft OLE DB Driver for SQL Server
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2024-04-09 - CVE-2024-28915 published to NVD
2025-01-07 - Last updated in NVD database

Technical Details for CVE-2024-28915

Vulnerability Analysis

The vulnerability resides in the Microsoft OLE DB Driver for SQL Server, the client-side component used by applications to communicate with SQL Server instances using the Tabular Data Stream (TDS) protocol. The driver mishandles data returned from a SQL Server during connection or query processing, leading to a heap-based buffer overflow. Exploitation requires user interaction: the victim must initiate a connection from an application using the vulnerable driver to a SQL Server instance controlled by the attacker. The attack vector is network-based, requires no privileges, and impacts confidentiality, integrity, and availability.

Root Cause

The root cause is improper validation of attacker-controlled data sizes during deserialization of server responses inside the OLE DB Driver. The driver allocates heap buffers based on values supplied by the remote server and then copies attacker-supplied bytes without verifying that the destination buffer is large enough. This produces an out-of-bounds heap write characteristic of [CWE-122].

Attack Vector

An attacker stands up a malicious SQL Server endpoint that returns crafted TDS responses. The attacker then induces a user or application to connect to that endpoint, for example through a connection string in a misconfigured client, a spear-phishing link that opens a database client, or compromise of a name resolution path. When the client driver parses the malicious response, the heap overflow occurs and can be steered toward control-flow hijack within the client process.

No public proof-of-concept code is available for CVE-2024-28915. Refer to the Microsoft CVE-2024-28915 Advisory for vendor-supplied technical details.

Detection Methods for CVE-2024-28915

Indicators of Compromise

Outbound TDS connections (TCP/1433 or custom SQL ports) from workstations to untrusted external IP addresses.
Unexpected crashes or access-violation events in processes loading msoledbsql.dll or sqlncli.dll.
New or modified ODBC and OLE DB connection strings pointing to unfamiliar hosts.
Child processes spawned from applications that normally only perform database I/O, such as Excel, SSMS, or custom line-of-business tools.

Detection Strategies

Monitor process telemetry for loads of the OLE DB Driver module followed by anomalous memory allocations, exception handling, or shellcode-like behavior.
Alert on database client applications establishing connections to public IP ranges or non-corporate SQL endpoints.
Inspect EDR crash dumps for heap corruption signatures inside msoledbsql.dll parsing routines.

Monitoring Recommendations

Inventory all hosts running the OLE DB Driver and SQL Server 2019/2022 and track patch state continuously.
Capture network flow data for outbound SQL traffic and baseline normal destinations to detect deviations.
Forward Windows Error Reporting and application crash events to a central SIEM for correlation against driver versions.

How to Mitigate CVE-2024-28915

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2024-28915 Advisory to all systems running the OLE DB Driver, SQL Server 2019, or SQL Server 2022.
Identify and patch developer workstations, application servers, and reporting hosts that ship with the OLE DB Driver as a redistributable.
Restrict outbound TDS traffic from client systems to only sanctioned internal SQL Server instances.

Patch Information

Microsoft has released fixed versions of the OLE DB Driver and the bundled SQL Server 2019 and 2022 components. Consult the Microsoft CVE-2024-28915 Advisory for the exact build numbers and download links applicable to each affected product. Verify driver versions after deployment by checking the file properties of msoledbsql.dll against Microsoft's published fixed versions.

Workarounds

Block outbound connections to untrusted SQL Server ports at the host firewall and network egress until patching is complete.
Disable or remove the OLE DB Driver on systems that do not require SQL Server connectivity.
Use application allowlisting to prevent unsanctioned database client tools from loading the driver.

bash

# Verify installed OLE DB Driver version on Windows
(Get-Item "$env:WINDIR\System32\msoledbsql.dll").VersionInfo | Format-List

# Block outbound TDS to non-corporate networks (example, adjust per environment)
New-NetFirewallRule -DisplayName "Block external TDS 1433" -Direction Outbound \
    -Protocol TCP -RemotePort 1433 -RemoteAddress Internet -Action Block