CVE-2024-38045: Windows 10 1809 TCP/IP RCE Vulnerability

CVE-2024-38045 Overview

CVE-2024-38045 is a remote code execution vulnerability in the Microsoft Windows TCP/IP networking stack. The flaw stems from a heap-based buffer overflow ([CWE-122]) in the kernel-mode network processing code. An unauthenticated attacker on the network can send specially crafted IPv6 packets to a vulnerable Windows host to trigger memory corruption and execute arbitrary code in kernel context. The vulnerability affects current Windows 10, Windows 11, and Windows Server releases. Microsoft addressed the issue in its September 2024 security updates. While no public proof-of-concept exists at the time of writing, similar TCP/IP vulnerabilities have been weaponized rapidly after disclosure.

Critical Impact
Successful exploitation grants attackers SYSTEM-level code execution over the network without authentication or user interaction, enabling full host compromise and lateral movement.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (21H2, 22H2, 23H2, 24H2) on x64 and ARM64
Microsoft Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2

Discovery Timeline

2024-09-10 - CVE-2024-38045 published to NVD alongside Microsoft's September 2024 Patch Tuesday release
2024-09-18 - Last updated in NVD database

Technical Details for CVE-2024-38045

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the Windows TCP/IP driver (tcpip.sys). The driver processes inbound network packets in kernel mode, so memory corruption in its parsing routines yields kernel-level code execution. Microsoft classifies the issue as remotely exploitable without authentication or user interaction, although the attack complexity is high. High attack complexity typically indicates that the attacker must win a race condition or manipulate non-deterministic state, such as heap layout, to achieve reliable exploitation. The vulnerability impacts confidentiality, integrity, and availability of the target host.

Root Cause

The root cause is improper validation of size or boundary conditions when handling crafted network packets in the kernel TCP/IP stack. The flaw is tracked under [CWE-122] (Heap-based Buffer Overflow). Microsoft has not published low-level technical details, consistent with its policy of withholding exploitation specifics for unpatched in-the-wild risk. Earlier 2024 Windows TCP/IP issues, such as CVE-2024-38063, located the defect in IPv6 packet processing logic, and CVE-2024-38045 falls in the same kernel networking component family.

Attack Vector

The attack vector is the network. An attacker sends crafted IP packets to any reachable interface on a vulnerable host. Hosts with IPv6 enabled and exposed to untrusted networks are at elevated risk because IPv6 packet processing in tcpip.sys has been the focal point of related defects. Internet-exposed Windows Servers and laptops on hostile networks are the most likely initial targets. Successful exploitation runs code in the kernel and can be chained with lateral-movement techniques to reach domain controllers or other high-value assets.

No verified public exploit code is available. See the Microsoft Security Update CVE-2024-38045 advisory for vendor guidance.

Detection Methods for CVE-2024-38045

Indicators of Compromise

Unexpected kernel crashes or BugCheck events referencing tcpip.sys on hosts exposed to untrusted networks
Unusual inbound IPv6 traffic with malformed extension headers or fragmented packets targeting Windows hosts
New SYSTEM-level processes, services, or scheduled tasks created shortly after spikes in inbound network activity
Outbound connections from System or kernel-spawned processes to unknown external infrastructure

Detection Strategies

Monitor tcpip.sys crash dumps and Windows Error Reporting telemetry for repeated faults that may indicate exploitation attempts
Deploy network IDS signatures for malformed IPv6 extension headers and abnormal fragmentation patterns targeting Windows hosts
Correlate kernel-mode anomalies with subsequent privileged process creation and lateral-movement activity
Track patch deployment status across Windows endpoints and servers to identify unpatched assets exposed to untrusted networks

Monitoring Recommendations

Enable verbose logging on perimeter firewalls and IPS devices for IPv6 traffic to internal Windows hosts
Forward Windows Event Logs (System, Security, Sysmon) and crash telemetry to a centralized analytics platform for correlation
Baseline normal IPv6 traffic volumes per host so abnormal bursts of crafted packets stand out
Audit perimeter exposure of SMB, RDP, and other Windows services that frequently accompany TCP/IP-stack attack chains

How to Mitigate CVE-2024-38045

Immediate Actions Required

Apply the September 2024 Microsoft security updates to every affected Windows 10, Windows 11, and Windows Server build listed in the advisory
Prioritize patching for internet-facing Windows Servers, VPN gateways, and any host with IPv6 enabled on untrusted networks
Inventory exposed Windows assets using vulnerability management tooling to confirm complete patch coverage
Restrict inbound IPv6 traffic at the perimeter to known, required sources until patching is complete

Patch Information

Microsoft released fixes for CVE-2024-38045 on September 10, 2024. Cumulative updates are available through Windows Update, WSUS, and the Microsoft Update Catalog. Refer to the Microsoft Security Update CVE-2024-38045 advisory for the exact KB article numbers that apply to each Windows build.

Workarounds

Disable IPv6 on hosts that do not require it, after testing for application dependencies, to reduce the attackable surface in tcpip.sys
Block inbound IPv6 traffic from untrusted networks at perimeter firewalls and segment Windows hosts away from hostile networks
Apply host-based firewall rules to restrict TCP/IP processing to known peers on isolated management networks
Remove direct internet exposure of Windows hosts where feasible and front them with hardened reverse proxies or VPN gateways

bash

# Example: disable IPv6 on a Windows host via PowerShell
# Test for application compatibility before applying at scale
Disable-NetAdapterBinding -Name "*" -ComponentID ms_tcpip6

# Verify the binding state
Get-NetAdapterBinding -ComponentID ms_tcpip6