CVE-2024-30075: Windows Server 2008 LLTD RCE Vulnerability

CVE-2024-30075 Overview

CVE-2024-30075 is a remote code execution vulnerability in the Windows Link Layer Topology Discovery (LLTD) Protocol. Microsoft published the advisory on June 11, 2024. The flaw affects Windows Server 2008 SP2 and Windows Server 2008 R2 SP1 across x86 and x64 platforms. Exploitation requires an adjacent-network position and user interaction on the target. Successful exploitation grants attackers the ability to execute arbitrary code with the privileges of the affected process. The vulnerability maps to [CWE-122: Heap-based Buffer Overflow].

Critical Impact
Adjacent-network attackers can execute arbitrary code on affected Windows Server 2008 systems, resulting in full confidentiality, integrity, and availability compromise.

Affected Products

Microsoft Windows Server 2008 SP2 (x86)
Microsoft Windows Server 2008 SP2 (x64)
Microsoft Windows Server 2008 R2 SP1 (x64)

Discovery Timeline

2024-06-11 - CVE-2024-30075 published to NVD and disclosed by Microsoft
2024-06-11 - Microsoft releases security update for CVE-2024-30075
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2024-30075

Vulnerability Analysis

The vulnerability resides in the Windows Link Layer Topology Discovery (LLTD) Protocol implementation. LLTD is used by Windows to discover and map devices on a local network segment. The protocol operates at Layer 2 using Ethernet type 0x88D9 and is not routable across networks. This constraint requires an attacker to reside on the same broadcast domain as the target. The vulnerability class ([CWE-122]) indicates a heap-based buffer overflow during processing of protocol messages. An attacker can craft malformed LLTD frames that overflow a heap allocation when parsed by the vulnerable component. The overflow enables corruption of adjacent heap metadata or objects, which can be leveraged for arbitrary code execution. The Microsoft advisory notes user interaction is required, indicating the vulnerable code path is triggered by a user-initiated action such as opening the Network Map or initiating device discovery.

Root Cause

The root cause is improper validation of size fields or field lengths in incoming LLTD messages. When the LLTD parser copies attacker-supplied data into a fixed-size heap buffer without proper bounds enforcement, it overflows the buffer. This produces the conditions for arbitrary code execution described in the Microsoft advisory.

Attack Vector

The attack vector is Adjacent Network. The attacker must be positioned on the same Layer 2 segment as the target. The attacker sends crafted LLTD frames toward the victim. A user on the target system must then perform an action that causes Windows to parse the malicious frames, such as invoking network topology discovery. The vulnerability then triggers heap corruption in the LLTD component. See the Microsoft Security Update for CVE-2024-30075 for vendor guidance. No public proof-of-concept or in-the-wild exploitation has been reported, and the CVE is not listed in the CISA KEV catalog.

Detection Methods for CVE-2024-30075

Indicators of Compromise

Unexpected LLTD (Ethertype 0x88D9) traffic originating from untrusted hosts on the local segment
Crashes or exceptions in lltdio.sys or lltdsvc.dll recorded in the Windows Event Log
Anomalous child processes spawned by the LLTD Mapper I/O or Responder services

Detection Strategies

Inspect Layer 2 traffic for malformed LLTD frames using switch port mirroring or network TAPs
Monitor for kernel-mode faults referencing the LLTD driver on Windows Server 2008 hosts
Correlate LLTD-related crash telemetry with subsequent process creation or lateral movement events

Monitoring Recommendations

Enable Windows Error Reporting and forward crash telemetry from legacy Windows Server 2008 systems to a central SIEM
Alert on unusual LLTD broadcast volumes or unexpected LLTD responders on server VLANs
Track outbound connections from Windows Server 2008 hosts immediately following LLTD activity

How to Mitigate CVE-2024-30075

Immediate Actions Required

Apply the Microsoft June 2024 security update referenced in the MSRC advisory to all affected Windows Server 2008 SP2 and Windows Server 2008 R2 SP1 systems
Inventory all Windows Server 2008 assets and prioritize patching hosts on user-accessible network segments
Restrict Layer 2 access to server VLANs and segment legacy Windows Server 2008 hosts from user networks

Patch Information

Microsoft addressed CVE-2024-30075 in the June 2024 Patch Tuesday release. The update is delivered through Extended Security Updates (ESU) channels for Windows Server 2008 and Windows Server 2008 R2, which are past mainstream end-of-support. Administrators should confirm ESU enrollment and validate that the applicable rollup is installed. Refer to the Microsoft Security Update for CVE-2024-30075 for update package identifiers.

Workarounds

Disable the LLTD Mapper I/O Driver (lltdio) and LLTD Responder (rspndr) network bindings on affected adapters where discovery is not required
Block Ethertype 0x88D9 at managed switches to prevent LLTD traffic from crossing between trust zones
Instruct users not to initiate Network Map or device discovery on unpatched Windows Server 2008 hosts

bash

# Disable LLTD bindings on all network adapters (run as Administrator)
Disable-NetAdapterBinding -Name "*" -ComponentID ms_lltdio
Disable-NetAdapterBinding -Name "*" -ComponentID ms_rspndr