CVE-2024-37340 Overview
CVE-2024-37340 is a remote code execution vulnerability in the Microsoft SQL Server Native Scoring feature. The flaw affects SQL Server 2016, 2017, 2019, and 2022, along with the SQL 2016 Azure Connect Feature Pack. An authenticated attacker with low privileges can trigger the vulnerability over the network to execute arbitrary code in the SQL Server process context. The weakness is classified under [CWE-822: Untrusted Pointer Dereference], reflecting improper handling of pointer references during native scoring operations. Successful exploitation compromises confidentiality, integrity, and availability of the database engine.
Critical Impact
An authenticated attacker can execute arbitrary code within the SQL Server process, leading to full compromise of database instances and any data they host.
Affected Products
- Microsoft SQL Server 2016 and SQL 2016 Azure Connect Feature Pack
- Microsoft SQL Server 2017 and 2019 (x64)
- Microsoft SQL Server 2022 (x64)
Discovery Timeline
- 2024-09-10 - CVE-2024-37340 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37340
Vulnerability Analysis
The vulnerability resides in the Native Scoring functionality of Microsoft SQL Server. Native Scoring allows the database engine to execute pre-trained machine learning models directly through the PREDICT T-SQL function without invoking external R or Python runtimes. Improper handling of pointer references within this code path allows a crafted model or scoring input to redirect execution flow. An attacker with authenticated database access can submit malicious model data that the engine dereferences without sufficient validation.
Because execution occurs inside the SQL Server service, successful exploitation yields code execution under the service account. Any databases, linked servers, or credentials accessible to that account become exposed. The attack requires network reachability to the SQL Server endpoint and low-privilege authentication, both common conditions in enterprise deployments.
Root Cause
The root cause is an untrusted pointer dereference [CWE-822] in the Native Scoring code path. The engine consumes attacker-controlled data that influences memory pointer values without validating their origin or bounds. When the engine follows the tainted pointer, it reads or writes memory outside expected structures, enabling control of execution flow.
Attack Vector
The attack is network-based and requires low-privilege authentication to the target SQL Server instance. An attacker who can execute PREDICT or a related native scoring operation submits crafted model bytes or scoring parameters. The engine parses this input, dereferences the malformed pointer, and executes attacker-controlled logic. No user interaction is required beyond the attacker's own session. See the Microsoft Security Update for CVE-2024-37340 for vendor technical details.
Detection Methods for CVE-2024-37340
Indicators of Compromise
- Unexpected child processes spawned by sqlservr.exe, particularly command interpreters such as cmd.exe, powershell.exe, or rundll32.exe.
- Anomalous use of the PREDICT T-SQL function against unfamiliar or newly imported models, especially from low-privilege accounts.
- SQL Server crash dumps or access violations logged in the SQL Server ERRORLOG referencing native scoring modules.
- Outbound network connections initiated by the SQL Server service account to previously unseen destinations.
Detection Strategies
- Monitor SQL Server audit logs for PREDICT invocations combined with CREATE or ALTER statements on model storage tables.
- Correlate process-creation telemetry with sqlservr.exe as the parent to identify code execution attempts.
- Baseline normal native scoring workloads and alert on deviations from expected model identifiers, sizes, or callers.
Monitoring Recommendations
- Enable SQL Server Audit for schema and data-access events on databases that store scoring models.
- Forward Windows Security and Sysmon events for SQL Server hosts to a central analytics platform for correlation.
- Track privilege assignments granting EXECUTE on native scoring procedures and review them regularly.
How to Mitigate CVE-2024-37340
Immediate Actions Required
- Apply Microsoft's September 2024 cumulative security updates for SQL Server 2016, 2017, 2019, and 2022 as listed in the MSRC advisory.
- Inventory SQL Server instances exposed to untrusted networks and prioritize patching internet-reachable or multi-tenant systems first.
- Review database logins with EXECUTE permissions on native scoring functions and revoke access that is not required.
- Rotate credentials for any SQL Server service account suspected of exposure during the vulnerability window.
Patch Information
Microsoft released fixed builds for all supported SQL Server versions through the Security Update Guide. Administrators should identify the exact build number for each instance and install the corresponding cumulative update or GDR package referenced in the Microsoft Security Update for CVE-2024-37340. Restart the SQL Server service after patching to complete installation.
Workarounds
- Restrict EXECUTE permission on the PREDICT function and related native scoring objects to trusted principals only.
- Isolate SQL Server instances behind network segmentation so that only application tiers can reach the database port.
- Disable native scoring in environments that do not use it until the security update is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
