CVE-2024-28941: Microsoft ODBC Driver RCE Vulnerability

CVE-2024-28941 Overview

CVE-2024-28941 is a remote code execution vulnerability in the Microsoft Open Database Connectivity (ODBC) Driver for SQL Server. The flaw is classified as a heap-based buffer overflow [CWE-122] and affects ODBC Driver installations on Windows, Linux, and macOS, as well as SQL Server 2019 and SQL Server 2022. An attacker can exploit the vulnerability over the network when a user interacts with a malicious target, such as connecting an affected client to an attacker-controlled SQL Server. Successful exploitation results in arbitrary code execution within the context of the connecting application.

Critical Impact
Successful exploitation allows attackers to execute arbitrary code on systems running the affected ODBC Driver or SQL Server, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft ODBC Driver for SQL Server (Windows, Linux, macOS)
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2024-04-09 - CVE-2024-28941 published to NVD
2025-01-14 - Last updated in NVD database

Technical Details for CVE-2024-28941

Vulnerability Analysis

The vulnerability resides in the Microsoft ODBC Driver for SQL Server, which provides client connectivity from applications to SQL Server instances. The flaw is a heap-based buffer overflow [CWE-122] triggered during processing of data exchanged between the ODBC client and a SQL Server endpoint. Exploitation requires user interaction, typically by inducing a victim application or user to initiate a connection to a malicious SQL Server. Once exploited, the attacker gains code execution within the process loading the ODBC driver, which often runs with the privileges of the calling application. The cross-platform scope, covering Windows, Linux, and macOS driver builds, broadens the attack surface across mixed enterprise environments.

Root Cause

The root cause is improper bounds checking on heap-allocated buffers within the ODBC Driver when parsing server-supplied data. Crafted responses from a malicious SQL Server can overflow these buffers, corrupting adjacent heap structures. Microsoft has not published low-level technical details for this issue beyond classifying it as a remote code execution flaw.

Attack Vector

The attack vector is network-based with low complexity and no required privileges, but user interaction is required. A typical exploitation scenario involves convincing a developer, database administrator, or automated service to connect an application using the vulnerable ODBC Driver to a SQL Server controlled by the attacker. The attacker then returns malformed protocol data that triggers the heap overflow inside the client process. Code execution occurs in the security context of the application initiating the ODBC connection. Refer to the Microsoft CVE-2024-28941 Update Guide for vendor-specific exploitation conditions.

No public proof-of-concept exploit code has been verified for this vulnerability. See the vendor advisory for additional technical details.

Detection Methods for CVE-2024-28941

Indicators of Compromise

Unexpected outbound TCP connections from application or database hosts to untrusted SQL Server endpoints on port 1433 or custom TDS ports.
Application or service crashes referencing msodbcsql modules in Windows Event Logs, macOS crash reports, or Linux core dumps.
Spawning of unexpected child processes (for example, cmd.exe, powershell.exe, or shell interpreters) from processes that load the ODBC driver.

Detection Strategies

Inventory all hosts with installed Microsoft ODBC Driver for SQL Server using software asset management and identify versions below the patched releases listed in the Microsoft advisory.
Monitor process telemetry for ODBC-consuming processes that load msodbcsql17.dll, msodbcsql18.dll, or platform equivalents and subsequently spawn shells or network listeners.
Inspect outbound TDS protocol traffic for connections to unsanctioned external SQL Server endpoints, which may indicate a victim being lured to a malicious server.

Monitoring Recommendations

Enable command-line and module-load auditing on workstations and servers that use ODBC connectivity, and forward events to a centralized SIEM for correlation.
Alert on heap corruption signatures, Windows Error Reporting events, or segmentation faults tied to ODBC driver libraries.
Establish allowlists of approved SQL Server destinations and alert on connection attempts to addresses outside the allowlist.

How to Mitigate CVE-2024-28941

Immediate Actions Required

Apply the security updates for Microsoft ODBC Driver for SQL Server and SQL Server 2019 and 2022 as listed in the Microsoft CVE-2024-28941 Update Guide.
Audit all systems, including Linux and macOS development environments, for outdated ODBC driver versions and prioritize remediation on internet-exposed hosts.
Educate developers and administrators to avoid connecting to untrusted SQL Server endpoints, particularly during incident response or proof-of-concept work.

Patch Information

Microsoft released patched versions of the ODBC Driver for SQL Server and corresponding updates for SQL Server 2019 and SQL Server 2022. Administrators should consult the Microsoft CVE-2024-28941 Update Guide for the exact driver build numbers and SQL Server cumulative updates that address this issue on each supported platform.

Workarounds

Restrict outbound TCP connectivity to SQL Server ports so that clients can only reach trusted, internal database servers.
Segment development and production networks to prevent ODBC clients from reaching arbitrary external endpoints over the TDS protocol.
Where patching is delayed, disable or uninstall the ODBC Driver for SQL Server on hosts that do not require SQL Server connectivity.

bash

# Example: verify installed ODBC driver version on Linux
odbcinst -q -d -n "ODBC Driver 18 for SQL Server"
cat /opt/microsoft/msodbcsql18/etc/odbcinst.ini

# Example: list installed ODBC drivers on Windows via PowerShell
Get-OdbcDriver | Where-Object { $_.Name -like "*SQL Server*" }