CVE-2024-29983: OLE DB Driver for SQL Server RCE Flaw

CVE-2024-29983 Overview

CVE-2024-29983 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw is classified as a heap-based buffer overflow [CWE-122] and affects the OLE DB Driver alongside SQL Server 2019 and SQL Server 2022 deployments. Microsoft published the advisory on April 9, 2024 as part of its monthly security release. Successful exploitation allows an attacker to execute arbitrary code in the context of the client process that connects to a malicious or compromised SQL Server. The attack requires user interaction, typically by convincing a victim to initiate a connection to an attacker-controlled SQL Server endpoint. The vulnerability carries a CVSS 3.1 base score of 8.8 and an EPSS probability of 3.993% (88.658 percentile).

Critical Impact
An attacker who controls a malicious SQL Server can execute arbitrary code on any client that connects using the vulnerable OLE DB driver, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft OLE DB Driver for SQL Server
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2024-04-09 - Microsoft releases security update for CVE-2024-29983
2024-04-09 - CVE-2024-29983 published to NVD
2025-01-15 - Last updated in NVD database

Technical Details for CVE-2024-29983

Vulnerability Analysis

The vulnerability resides in the Microsoft OLE DB Driver for SQL Server, a client-side data access component used by applications to communicate with SQL Server. The driver mishandles data returned from a SQL Server during connection or query processing, resulting in a heap-based buffer overflow [CWE-122]. The flaw is triggered on the client side, not the server side. An attacker hosting a malicious SQL Server can return crafted Tabular Data Stream (TDS) responses that overflow a heap allocation in the driver. The overflow corrupts adjacent heap structures and can be leveraged to achieve arbitrary code execution under the security context of the connecting application.

Root Cause

The root cause is insufficient validation of the length or structure of attacker-controlled fields in server responses parsed by the OLE DB driver. When the driver copies these fields into a fixed-size heap buffer, the bounds check fails and adjacent memory is overwritten. Heap metadata and object pointers in the corrupted region can be manipulated to redirect execution flow.

Attack Vector

Exploitation requires a victim application or user to initiate an outbound connection to a SQL Server endpoint controlled by the attacker. This is achievable through phishing, malicious Office Data Connection (.odc) files, crafted UDL files, or social engineering that prompts a database administrator to register an attacker-controlled linked server. Once the connection is established, the malicious server returns the crafted TDS payload and triggers the overflow without further interaction. The vulnerability operates over the network, requires low attack complexity, and needs no prior authentication on the client side.

Microsoft has not published exploit details. See the Microsoft Security Response Center advisory for the official technical references.

Detection Methods for CVE-2024-29983

Indicators of Compromise

Outbound TDS connections (TCP/1433 by default) from workstations or application servers to untrusted or unexpected external IP addresses.
Unexpected child processes spawned by applications that load msoledbsql.dll, such as Excel, Power BI, SSMS, or custom .NET and C++ database clients.
Crash dumps or Windows Error Reporting events referencing heap corruption inside msoledbsql.dll.
Newly created or modified Universal Data Link (.udl), Office Data Connection (.odc), or connection string files referencing untrusted SQL Server hosts.

Detection Strategies

Inventory endpoints and servers for vulnerable versions of msoledbsql.dll and the SQL Server Native Client and correlate against Microsoft's patched build numbers.
Hunt for processes that load the OLE DB driver and subsequently exhibit shellcode behavior such as memory allocation with PAGE_EXECUTE_READWRITE, suspicious thread creation, or LOLBin execution.
Use behavioral identification on database client processes that initiate connections to non-corporate SQL Server endpoints.
Apply YARA or memory scanning rules to flag heap corruption patterns and ROP gadget sequences in msoledbsql.dll address space.

Monitoring Recommendations

Log and alert on outbound TDS traffic that egresses the corporate boundary, especially from user workstations.
Forward EDR telemetry for msoledbsql.dll load events and child-process creation into a centralized analytics platform for correlation.
Monitor application crash telemetry and Windows Event Log entries (Application Error, event ID 1000) referencing the OLE DB driver module.
Track changes to linked server definitions in SQL Server and to data source files distributed via shared drives or email.

How to Mitigate CVE-2024-29983

Immediate Actions Required

Apply the Microsoft security updates released on April 9, 2024 for the OLE DB Driver for SQL Server, SQL Server 2019, and SQL Server 2022 across all client and server systems.
Identify every application that bundles or depends on msoledbsql.dll and update redistributables shipped with those applications.
Restrict outbound TCP/1433 and other SQL Server ports at the network perimeter so clients cannot reach attacker-controlled servers.
Educate database administrators and analysts to avoid connecting to untrusted SQL Server endpoints and opening unsolicited .odc or .udl files.

Patch Information

Microsoft addressed CVE-2024-29983 in the April 2024 security update cycle. Patched versions are listed in the Microsoft CVE-2024-29983 Update Guide. Administrators should install the cumulative update for SQL Server 2019 and SQL Server 2022 as well as the standalone Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL) redistributable on every system that hosts the driver, including developer workstations, application servers, and ETL hosts.

Workarounds

Block outbound connections to untrusted SQL Server endpoints using host-based or perimeter firewalls until patches are deployed.
Remove or disable the Microsoft OLE DB Driver for SQL Server on systems that do not require database connectivity.
Enforce application allowlisting to prevent unauthorized database client tooling from loading the vulnerable driver.
Configure SQL clients to connect only to a curated allowlist of approved server hostnames or IP addresses.

bash

# Example: block outbound TDS traffic to non-approved destinations on Windows hosts
New-NetFirewallRule -DisplayName "Block Outbound SQL TDS" \
  -Direction Outbound \
  -Protocol TCP \
  -RemotePort 1433,1434 \
  -RemoteAddress Any \
  -Action Block \
  -Profile Any

# Allow only approved SQL Server hosts
New-NetFirewallRule -DisplayName "Allow Approved SQL Servers" \
  -Direction Outbound \
  -Protocol TCP \
  -RemotePort 1433 \
  -RemoteAddress 10.10.20.0/24 \
  -Action Allow \
  -Profile Any