CVE-2024-37329: Microsoft SQL Server 2016 RCE Vulnerability

CVE-2024-37329 Overview

CVE-2024-37329 is a remote code execution vulnerability in the Microsoft SQL Server Native Client OLE DB Provider. The flaw affects Microsoft SQL Server 2016, 2017, 2019, and 2022. Microsoft classifies the issue under [CWE-122] (heap-based buffer overflow), indicating memory corruption in the client provider when processing responses from a malicious server.

Exploitation requires user interaction: an attacker must convince an authenticated user to connect a vulnerable client to an attacker-controlled SQL Server instance. A successful attack permits arbitrary code execution in the context of the connecting application.

Critical Impact

Successful exploitation yields remote code execution on the client process connecting to a malicious SQL Server, with full impact to confidentiality, integrity, and availability.

Affected Products

• Microsoft SQL Server 2016
• Microsoft SQL Server 2017
• Microsoft SQL Server 2019
• Microsoft SQL Server 2022

Discovery Timeline

• 2024-07-09 - CVE-2024-37329 published to NVD
• 2024-07-09 - Microsoft releases security update for CVE-2024-37329
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-37329

Vulnerability Analysis

The vulnerability resides in the SQL Server Native Client OLE DB Provider (sqlncli), the legacy data access component used by applications to communicate with SQL Server via the Tabular Data Stream (TDS) protocol. The provider mishandles memory when parsing server-supplied data, producing a heap-based buffer overflow [CWE-122].

An attacker who controls a SQL Server endpoint can return crafted TDS responses that overflow heap structures inside the client process. The corrupted heap state enables control of execution flow within the application that loaded sqlncli. The provider is commonly embedded in business applications, ETL tools, reporting agents, and SQL Server Integration Services packages, expanding the potential attack surface beyond database administrators.

Root Cause

The root cause is improper bounds checking when the OLE DB Provider deserializes structured server responses into client-side heap buffers. Field length values supplied by the server are trusted without validation, allowing a malformed response to write past the bounds of a fixed-size allocation. The heap corruption can be shaped to overwrite adjacent metadata or function pointers within the client process.

Attack Vector

Attackers exploit this vulnerability through a malicious or compromised SQL Server. The victim must initiate a connection from a system with the vulnerable Native Client installed, typically by opening a connection string, running a query tool, or executing an application that uses sqlncli11.dll or sqloledb.dll. Phishing lures referencing database links, ODBC data sources, or .udl files are realistic delivery methods. Once the connection is established, the malicious server returns crafted TDS packets that trigger the overflow during response parsing.

No verified public proof-of-concept code is available for CVE-2024-37329. Refer to the Microsoft Security Update CVE-2024-37329 advisory for vendor-supplied technical details.

Detection Methods for CVE-2024-37329

Indicators of Compromise

• Outbound TDS connections (TCP/1433 or dynamic ports) from workstations or application servers to untrusted or external IP addresses.
• Unexpected child processes spawned by applications that load sqlncli11.dll, sqloledb.dll, or msoledbsql.dll.
• Crash dumps or Windows Error Reporting events referencing the SQL Server Native Client modules with access violation exceptions.

Detection Strategies

• Inventory hosts loading the SQL Server Native Client and Microsoft OLE DB Driver for SQL Server using endpoint telemetry on module loads.
• Alert on processes hosting sqlncli modules that initiate network connections to non-corporate SQL Server endpoints.
• Hunt for anomalous post-exploitation behavior originating from database client applications, such as PowerShell, cmd.exe, or LOLBins launched from Excel, SSMS, or SSIS runtime processes.

Monitoring Recommendations

• Enable Sysmon Event ID 7 (Image Load) and Event ID 3 (Network Connect) to correlate Native Client usage with outbound TDS sessions.
• Restrict SQL Server destinations through egress firewall rules and alert on TDS traffic crossing the network perimeter.
• Review Windows Application event logs for repeated faulting modules tied to sqlncli11.dll or msoledbsql.dll.

How to Mitigate CVE-2024-37329

Immediate Actions Required

• Apply the Microsoft July 2024 security updates for all affected SQL Server 2016, 2017, 2019, and 2022 builds, including GDR and CU branches.
• Update client systems that distribute the SQL Server Native Client or Microsoft OLE DB Driver for SQL Server, not only database servers.
• Identify and inventory applications still depending on the deprecated SQL Server Native Client (SQLNCLI/SQLNCLI11) and plan migration to the supported Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL).

Patch Information

Microsoft published fixes for CVE-2024-37329 in the July 2024 Patch Tuesday cycle. Each supported SQL Server major version received a corresponding cumulative update or GDR patch. Refer to the Microsoft Security Update CVE-2024-37329 advisory for build numbers, KB identifiers, and download links specific to each branch.

Workarounds

• Block outbound TCP/1433 and dynamic SQL Server ports to untrusted destinations to prevent clients from reaching attacker-controlled servers.
• Restrict installation of SQL Server Native Client to systems with a documented business need and remove it from general-purpose workstations.
• Train users to refuse connection prompts and .udl or connection string files received via email or untrusted sources.

# Configuration example: list installed SQL Server client providers on Windows
Get-WmiObject -Class Win32_Product | Where-Object {
    $_.Name -like "*SQL Server Native Client*" -or
    $_.Name -like "*Microsoft OLE DB Driver for SQL Server*"
} | Select-Object Name, Version, InstallDate