CVE-2024-37336: SQL Server 2016 RCE Vulnerability

CVE-2024-37336 Overview

CVE-2024-37336 is a remote code execution vulnerability in the SQL Server Native Client Object Linking and Embedding Database (OLE DB) Provider. The flaw affects Microsoft SQL Server 2016, 2017, 2019, and 2022. Microsoft published the advisory on July 9, 2024. The vulnerability carries a CVSS 3.1 score of 8.8 and is associated with [CWE-190] Integer Overflow or Wraparound.

Exploitation requires a victim to connect to an attacker-controlled SQL Server instance using OLE DB. Successful exploitation lets an attacker execute arbitrary code in the context of the client process. The EPSS score is 3.259% (87.3 percentile), indicating elevated exploitation likelihood relative to the broader CVE population.

Critical Impact

An attacker who tricks a client into connecting to a malicious SQL Server can execute arbitrary code on the client host, with full confidentiality, integrity, and availability impact.

Affected Products

• Microsoft SQL Server 2016
• Microsoft SQL Server 2017
• Microsoft SQL Server 2019
• Microsoft SQL Server 2022

Discovery Timeline

• 2024-07-09 - CVE-2024-37336 published to NVD
• 2024-07-09 - Microsoft releases security update via Microsoft CVE-2024-37336 Advisory
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-37336

Vulnerability Analysis

The vulnerability resides in the SQL Server Native Client (SQLNCLI) OLE DB Provider, the client-side data access component used by applications connecting to SQL Server. The flaw is an integer overflow [CWE-190] triggered during data exchange between the client and a SQL Server instance.

When the OLE DB provider parses specific server-supplied data structures, an arithmetic operation on a length or count field wraps around. The resulting undersized allocation or miscalculated boundary leads to memory corruption. An attacker controlling the server response can shape the corrupted memory to redirect execution flow into attacker-supplied content.

Because the vulnerable code path is the client OLE DB provider, code execution occurs in the process that initiated the connection — typically a business application, reporting service, or administrative tool — not the server itself.

Root Cause

The root cause is an integer overflow during the handling of network responses inside the SQL Server Native Client OLE DB Provider. The component fails to validate that arithmetic on attacker-influenced size fields stays within safe bounds before using the result to size a buffer or index memory.

Attack Vector

Exploitation is network-based and requires user interaction. A user must be convinced to connect a vulnerable client to an attacker-controlled SQL Server endpoint, for example through a crafted connection string, a malicious linked server entry, or a phishing lure that triggers a database tool. No privileges on the target client are required prior to exploitation. Refer to the Microsoft Security Response Center advisory for protocol-level details.

Detection Methods for CVE-2024-37336

Indicators of Compromise

• Outbound TDS (TCP 1433 or dynamic) connections from workstations or application servers to untrusted external IP addresses.
• Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by applications that load sqlncli11.dll, msoledbsql.dll, or other OLE DB provider DLLs.
• Unexpected loading of SQL Server Native Client libraries by Office applications, browsers, or scripting hosts.
• Crash dumps or Windows Error Reporting events referencing access violations inside sqlncli*.dll or msoledbsql*.dll.

Detection Strategies

• Hunt for processes loading the OLE DB provider DLL that subsequently initiate outbound TCP connections to non-corporate database endpoints.
• Build behavioral analytics that correlate SQL Server Native Client module loads with anomalous child-process creation, a sequence indicative of post-exploitation code execution.
• Inspect endpoint telemetry for memory protection violations (DEP/CFG) inside SQL client processes connecting to external hosts.

Monitoring Recommendations

• Enable Sysmon Event IDs 3 (network connect), 7 (image load), and 10 (process access) on hosts running SQL client tooling and ingest into a SIEM or data lake for correlation.
• Restrict and alert on outbound TDS traffic at the network perimeter; only known database endpoints should be reachable from client subnets.
• Apply behavioral identification on endpoints to flag exploitation patterns originating from data access libraries, where platforms such as Singularity Endpoint can correlate module load, memory corruption, and post-exploitation child-process activity.

How to Mitigate CVE-2024-37336

Immediate Actions Required

• Apply the July 2024 Microsoft security updates for SQL Server 2016, 2017, 2019, and 2022 on every host running the SQL Server Native Client or MSOLEDBSQL provider.
• Inventory client systems with sqlncli11.dll or msoledbsql.dll loaded; clients are in scope even when no SQL Server instance is installed locally.
• Block outbound TDS (default TCP 1433) traffic from user workstations to untrusted destinations.
• Educate administrators and developers to avoid connecting database tools to untrusted SQL Server endpoints.

Patch Information

Microsoft released cumulative updates addressing CVE-2024-37336 on July 9, 2024. Patch availability and KB numbers per SQL Server version are documented in the Microsoft CVE-2024-37336 Advisory. Update both server installations and any standalone client redistributables (SQL Server Native Client, MSOLEDBSQL).

Workarounds

• Restrict outbound connections from client hosts to a defined allowlist of internal SQL Server instances using host firewall rules or network segmentation.
• Remove unused legacy SQL Server Native Client redistributables from endpoints where modern providers can be used instead.
• Enforce application allowlisting so that only approved processes can load OLE DB provider DLLs and initiate database connections.

# Example: block outbound TDS to non-approved destinations on Windows clients
New-NetFirewallRule -DisplayName "Block Outbound TDS to Untrusted" \
  -Direction Outbound -Protocol TCP -RemotePort 1433 \
  -RemoteAddress Any -Action Block -Profile Any

# Allow only approved internal SQL servers
New-NetFirewallRule -DisplayName "Allow Outbound TDS to Approved SQL" \
  -Direction Outbound -Protocol TCP -RemotePort 1433 \
  -RemoteAddress 10.10.20.0/24 -Action Allow -Profile Any