CVE-2024-28927: OLE DB Driver for SQL Server RCE Flaw

CVE-2024-28927 Overview

CVE-2024-28927 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw affects the OLE DB Driver shipped with Microsoft SQL Server 2019 and SQL Server 2022 on x64 platforms. An attacker can exploit the vulnerability by convincing an authenticated user to connect to a malicious SQL Server instance, which then returns crafted responses that trigger a heap-based buffer overflow [CWE-122] in the client driver. Successful exploitation results in arbitrary code execution in the context of the connecting application.

Critical Impact

Exploitation allows attackers to execute arbitrary code on systems running vulnerable OLE DB Driver versions, compromising confidentiality, integrity, and availability of the host application.

Affected Products

• Microsoft OLE DB Driver for SQL Server
• Microsoft SQL Server 2019 (x64)
• Microsoft SQL Server 2022 (x64)

Discovery Timeline

• 2024-04-09 - CVE-2024-28927 published to NVD and addressed in Microsoft's April 2024 security update
• 2025-01-15 - Last updated in NVD database

Technical Details for CVE-2024-28927

Vulnerability Analysis

The vulnerability resides in how the Microsoft OLE DB Driver for SQL Server parses server-side responses from a SQL Server endpoint. The driver fails to correctly validate the size of attacker-controlled data before copying it into a heap-allocated buffer. This results in a heap-based buffer overflow classified as [CWE-122], which corrupts adjacent heap memory and enables control-flow hijacking.

Exploitation requires user interaction. An attacker must induce a victim application or user to initiate an OLE DB connection to an attacker-controlled SQL Server instance. Once the malicious server returns a crafted protocol response, the driver overflows the destination buffer during deserialization. Attackers can then execute arbitrary code with the privileges of the process loading the driver, frequently a service account or database client application.

Root Cause

The root cause is improper bounds checking when the OLE DB Driver processes Tabular Data Stream (TDS) protocol fields returned by a server. Length-prefixed fields are trusted without validation against the destination buffer size, producing the heap overflow condition.

Attack Vector

The attack vector is network-based. A victim with the vulnerable driver installed connects, via any application using OLE DB, to a SQL Server instance controlled by the attacker. The attacker does not require valid credentials on the victim host, but the user must initiate the connection, satisfying the user-interaction requirement.

No public proof-of-concept code is available for this vulnerability. Technical details are described in prose; refer to the Microsoft Security Update Guide for CVE-2024-28927 for vendor-provided information.

Detection Methods for CVE-2024-28927

Indicators of Compromise

• Outbound TDS connections (TCP/1433 or custom ports) from workstations or application servers to untrusted external SQL Server hosts.
• Unexpected child processes spawned by applications that load msoledbsql.dll or oledb32.dll.
• Crashes or anomalous memory faults in processes that consume the OLE DB Driver, recorded in Windows Error Reporting.

Detection Strategies

• Inventory hosts loading vulnerable versions of msoledbsql.dll and correlate with installed SQL Server 2019 and 2022 build numbers.
• Hunt for SQL client processes establishing TDS sessions to IP addresses outside approved database subnets.
• Alert on process injection or shellcode behavior originating from processes that have recently loaded the OLE DB Driver.

Monitoring Recommendations

• Enable command-line and module-load auditing on application and database servers to capture OLE DB Driver usage.
• Forward Sysmon Event ID 7 (Image loaded) and Event ID 3 (Network connection) telemetry to a centralized analytics platform.
• Monitor egress firewall logs for SQL Server protocol traffic to non-corporate destinations and investigate anomalies.

How to Mitigate CVE-2024-28927

Immediate Actions Required

• Apply the Microsoft April 2024 security update for SQL Server 2019, SQL Server 2022, and the standalone OLE DB Driver for SQL Server.
• Update the redistributable msoledbsql package on all client systems and application servers that connect to SQL Server.
• Restrict outbound TDS traffic to known, approved database hosts using firewall rules.

Patch Information

Microsoft addressed CVE-2024-28927 in the April 2024 Patch Tuesday release. Updated installers for the Microsoft OLE DB Driver for SQL Server, along with cumulative updates for SQL Server 2019 and SQL Server 2022, are available through the Microsoft Security Update Guide. Administrators should validate the installed version of msoledbsql.dll after deployment.

Workarounds

• Block outbound connections on TCP/1433 and other configured SQL Server ports to untrusted networks at the perimeter.
• Enforce application allow-listing so only sanctioned SQL client tools can load the OLE DB Driver.
• Educate users to avoid connecting to unknown SQL Server instances received via email, links, or documents.

# Verify installed OLE DB Driver version on Windows hosts
powershell -Command "Get-Item 'C:\Program Files\Common Files\System\Ole DB\msoledbsql.dll' | Select-Object -ExpandProperty VersionInfo"