CVE-2024-28934: ODBC Driver for SQL Server RCE Flaw

CVE-2024-28934 Overview

CVE-2024-28934 is a remote code execution vulnerability in the Microsoft ODBC Driver for SQL Server. The flaw is categorized as a stack-based buffer overflow [CWE-121] and affects the driver across Windows, Linux, and macOS, as well as SQL Server 2019, SQL Server 2022, Visual Studio 2019, and Visual Studio 2022 deployments that bundle the driver. An attacker can trigger code execution in the context of the client process when a vulnerable client connects to an attacker-controlled SQL Server endpoint. Exploitation requires user interaction, typically initiating a database connection.

Critical Impact
Successful exploitation gives attackers code execution on the client system with the privileges of the application invoking the ODBC driver, compromising confidentiality, integrity, and availability.

Affected Products

Microsoft ODBC Driver for SQL Server (Windows, Linux, macOS)
Microsoft SQL Server 2019 and SQL Server 2022 (x64)
Microsoft Visual Studio 2019 and Visual Studio 2022

Discovery Timeline

2024-04-09 - CVE-2024-28934 published to NVD as part of Microsoft's April 2024 Patch Tuesday
2025-01-14 - Last updated in NVD database

Technical Details for CVE-2024-28934

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] in the Microsoft ODBC Driver for SQL Server. The driver fails to validate the length of attacker-controlled data parsed from server responses before copying it into a fixed-size stack buffer. Once the buffer is overwritten, adjacent stack memory, including the saved return address and local control structures, can be corrupted.

The attack vector is network-based and targets the client side of the database connection. A malicious or compromised SQL Server instance returns crafted Tabular Data Stream (TDS) protocol messages to the connecting client. When the ODBC driver processes those messages, the overflow occurs inside the client process.

Exploitation results in arbitrary code execution within the application that loaded the ODBC driver. This includes administrative tools, custom database clients, web application servers, and integrated developer tooling shipped with Visual Studio and SQL Server.

Root Cause

The root cause is improper bounds checking on response data from the server. The driver trusts length fields supplied by the remote SQL endpoint and writes into a stack buffer without verifying that the input fits.

Attack Vector

An attacker hosts a malicious SQL Server endpoint or hijacks the network path to a legitimate one. The attacker then induces a victim, through phishing, a malicious connection string, or compromised tooling, to connect using a vulnerable ODBC driver. The crafted TDS response triggers the overflow during the connection or query phase, leading to code execution in the client process.

No authentication is required on the client side. User interaction is required to initiate the outbound database connection.

Detection Methods for CVE-2024-28934

Indicators of Compromise

Outbound SQL Server connections from workstations or build servers to untrusted external IP addresses on TCP port 1433 or other configured SQL listener ports.
Unexpected child processes spawned by applications that host the ODBC driver, such as sqlcmd.exe, devenv.exe, or custom data integration tools.
Crashes or anomalous memory access exceptions in processes that load msodbcsql*.dll on Windows or libmsodbcsql*.so/.dylib on Linux and macOS.

Detection Strategies

Inventory client systems and identify all installations of the Microsoft ODBC Driver for SQL Server, including those bundled with SQL Server 2019/2022 and Visual Studio 2019/2022.
Hunt for process executions where ODBC-consuming applications connect to SQL Server endpoints outside approved network ranges.
Correlate driver module load events with subsequent suspicious behavior such as command shell invocation, script interpreter execution, or LSASS access.

Monitoring Recommendations

Log and alert on egress TDS traffic to non-corporate destinations from developer workstations and CI/CD agents.
Enable Windows Defender Exploit Guard or equivalent exploit mitigations on hosts running database client tooling.
Monitor module load telemetry for msodbcsql17.dll, msodbcsql18.dll, and platform equivalents to baseline expected hosts.

How to Mitigate CVE-2024-28934

Immediate Actions Required

Apply the updated Microsoft ODBC Driver for SQL Server versions as referenced in the Microsoft Security Update Guide.
Patch all SQL Server 2019 and SQL Server 2022 (x64) instances that bundle the affected driver, plus Visual Studio 2019 and 2022 installations.
Restrict outbound TCP 1433 and other SQL listener ports from end-user workstations to known, trusted database servers only.

Patch Information

Microsoft released fixed versions of the ODBC Driver for SQL Server, alongside SQL Server and Visual Studio updates, in the April 2024 security update cycle. Refer to the Microsoft Security Update Guide for the exact build numbers applicable to each platform (Windows, Linux distributions, macOS) and product channel.

Workarounds

Block outbound connections to untrusted SQL Server endpoints at the network perimeter and via host firewall policy.
Configure database client applications to use Force Encryption and validate server certificates to reduce the attack surface from rogue or man-in-the-middle servers.
Remove the ODBC Driver for SQL Server from systems where it is not required, particularly developer workstations with broad internet egress.

bash

# Example: enumerate installed ODBC Driver versions on Windows
Get-OdbcDriver | Where-Object { $_.Name -like 'ODBC Driver * for SQL Server' } | \
  Select-Object Name, Platform, Attribute

# Example: restrict outbound SQL traffic on Linux hosts to an approved server list
sudo iptables -A OUTPUT -p tcp --dport 1433 -d 10.10.20.0/24 -j ACCEPT
sudo iptables -A OUTPUT -p tcp --dport 1433 -j DROP