CVE-2024-35272: SQL Server 2016 RCE Vulnerability

CVE-2024-35272 Overview

CVE-2024-35272 is a remote code execution vulnerability in the Microsoft SQL Server Native Client OLE DB Provider. The flaw is rooted in a heap-based buffer overflow condition [CWE-122] that affects SQL Server 2016, 2017, 2019, and 2022. Successful exploitation requires an authenticated user to connect to a malicious SQL Server instance, after which an attacker can execute arbitrary code in the context of the client process.

Critical Impact

An attacker controlling a malicious SQL Server endpoint can execute arbitrary code on a client that connects through the SQL Server Native Client OLE DB Provider, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

• Microsoft SQL Server 2016
• Microsoft SQL Server 2017
• Microsoft SQL Server 2019
• Microsoft SQL Server 2022

Discovery Timeline

• 2024-07-09 - CVE-2024-35272 published to the National Vulnerability Database (NVD)
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-35272

Vulnerability Analysis

The vulnerability resides in the SQL Server Native Client (SNAC) OLE DB Provider, a client-side database access component used by applications to connect to SQL Server. The component improperly handles attacker-controlled data returned from a SQL Server instance, resulting in a heap-based buffer overflow [CWE-122]. An attacker who controls or impersonates a SQL Server endpoint can craft network responses that corrupt heap memory in the connecting client.

Exploitation requires user interaction, typically a victim being convinced to connect to an attacker-controlled SQL Server. Once a connection is established, the attacker can deliver a malicious response that triggers the overflow and hijacks execution. The vulnerability carries an EPSS probability of 4.031%, placing it in the 88th percentile of likelihood of exploitation activity.

Root Cause

The root cause is improper validation of the size of data structures returned by the server before they are copied into a fixed-size heap allocation inside the OLE DB Provider. When a response exceeds expected boundaries, adjacent heap memory is overwritten. Attackers can leverage this corruption to alter control data such as function pointers or vtables and redirect execution.

Attack Vector

Exploitation is network-based but client-driven. An attacker stands up a malicious SQL Server endpoint or performs a machine-in-the-middle attack against legitimate traffic. The victim must initiate or be tricked into initiating a connection from an application using the affected OLE DB Provider. Because the provider runs inside the application process, code execution occurs with the privileges of the connecting user, providing a foothold for lateral movement, credential theft, or persistence.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details on the heap corruption pattern are described in the Microsoft CVE-2024-35272 Advisory.

Detection Methods for CVE-2024-35272

Indicators of Compromise

• Unexpected outbound TCP connections from workstations or application servers to untrusted SQL Server endpoints on port 1433 or non-standard ports.
• Crashes or anomalous termination of processes that load sqlncli11.dll, msoledbsql.dll, or related OLE DB Provider libraries.
• Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned from applications hosting the SQL Server Native Client.
• New persistence artifacts (scheduled tasks, run keys, services) created shortly after an SQL connection event from a user workstation.

Detection Strategies

• Monitor for processes loading the SQL Server Native Client OLE DB Provider libraries and correlate with subsequent process creation events.
• Inspect endpoint telemetry for heap corruption signatures: faulting module set to the OLE DB Provider and exception codes such as 0xC0000374 or 0xC0000005.
• Apply network detection rules to flag SQL Server connections to IPs outside the approved internal database segment.

Monitoring Recommendations

• Inventory all hosts where the SQL Server Native Client is installed and track its version against the patched build.
• Enable Windows Defender Exploit Guard or equivalent control-flow integrity logging on hosts that run database client applications.
• Forward Sysmon Image Loaded (Event ID 7) and Process Create (Event ID 1) events for OLE DB Provider DLLs to a centralized SIEM for correlation.

How to Mitigate CVE-2024-35272

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft CVE-2024-35272 Advisory to all affected SQL Server installations and clients.
• Identify and update applications that bundle older versions of the SQL Server Native Client (sqlncli) or the Microsoft OLE DB Driver for SQL Server (msoledbsql).
• Restrict outbound SQL Server traffic from user workstations so that only approved database hosts can be reached.
• Educate users to avoid connecting database tools to untrusted SQL Server endpoints received via email, links, or shared connection strings.

Patch Information

Microsoft has released security updates that resolve the heap-based buffer overflow in the SQL Server Native Client OLE DB Provider for SQL Server 2016, 2017, 2019, and 2022. Refer to the Microsoft CVE-2024-35272 Advisory for the exact cumulative update and GDR builds that contain the fix.

Workarounds

• Block outbound TCP/1433 and other SQL Server ports at the perimeter and host firewall for endpoints that do not require external database access.
• Where possible, migrate applications from the deprecated SQL Server Native Client to a supported and patched driver such as the Microsoft OLE DB Driver for SQL Server.
• Enforce authenticated, certificate-validated TLS connections to SQL Server to reduce the risk of machine-in-the-middle redirection to attacker-controlled endpoints.

# Configuration example: restrict outbound SQL Server traffic on Windows endpoints
New-NetFirewallRule -DisplayName "Block Outbound SQL Server" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 1433,1434 `
  -Action Block `
  -Profile Any