CVE-2024-38072: Windows Server 2016 DoS Vulnerability

CVE-2024-38072 Overview

CVE-2024-38072 is a denial of service vulnerability in the Windows Remote Desktop Licensing Service affecting multiple supported versions of Windows Server. The flaw is network-accessible and requires no authentication or user interaction, allowing remote attackers to disrupt the licensing service and impact availability of Remote Desktop Services environments. Microsoft assigned this vulnerability CWE-476 (NULL Pointer Dereference). The vulnerability was published to the National Vulnerability Database on July 9, 2024.

Critical Impact

Unauthenticated remote attackers can crash the Remote Desktop Licensing Service, denying access to Remote Desktop Session Host deployments that depend on it.

Affected Products

• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022 (including 23H2)

Discovery Timeline

• 2024-07-09 - CVE-2024-38072 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-38072

Vulnerability Analysis

The vulnerability resides in the Windows Remote Desktop Licensing Service, a component that issues and manages Remote Desktop Services (RDS) client access licenses (CALs) for session host deployments. An unauthenticated remote attacker can send crafted network traffic to the licensing service to trigger a denial of service condition. The current EPSS data indicates a 14.041% probability of exploitation activity, placing this issue in the 94th percentile of all tracked vulnerabilities.

Root Cause

Microsoft classified the underlying weakness as CWE-476, a NULL pointer dereference. The licensing service dereferences a pointer that can be NULL under attacker-controlled input conditions, causing the service process to terminate abnormally. Microsoft has not publicly disclosed deeper technical specifics of the vulnerable code path.

Attack Vector

The attack vector is network-based and unauthenticated. An adversary with network reachability to a host running the Remote Desktop Licensing role can send specially crafted requests to the service to crash it. Successful exploitation produces no confidentiality or integrity impact, but disrupts licensing operations for RDS session hosts that depend on the licensing server.

No public proof-of-concept exploit code is currently published for CVE-2024-38072. For authoritative technical details refer to the Microsoft Security Advisory.

Detection Methods for CVE-2024-38072

Indicators of Compromise

• Repeated unexpected crashes or restarts of the TermServLicensing service on Windows Server hosts.
• Windows Event Log entries showing service termination, application errors, or watchdog restarts associated with the Remote Desktop Licensing process.
• Unusual inbound network traffic to RDS licensing endpoints from untrusted sources.

Detection Strategies

• Monitor Windows Service Control Manager events (Event IDs 7031, 7034) for TermServLicensing faults.
• Correlate licensing service failures with concurrent inbound network flows to the licensing host.
• Alert on RDS session hosts reporting licensing grace period warnings or failed CAL issuance.

Monitoring Recommendations

• Forward Windows event logs from RDS licensing servers to a centralized SIEM for correlation and alerting.
• Track availability metrics for the Remote Desktop Licensing role and trigger alerts on service downtime thresholds.
• Review perimeter firewall and network telemetry for exposure of licensing service ports to untrusted networks.

How to Mitigate CVE-2024-38072

Immediate Actions Required

• Apply the July 2024 Microsoft security updates that address CVE-2024-38072 on all Windows Server 2016, 2019, and 2022 systems running the Remote Desktop Licensing role.
• Inventory all hosts with the Remote Desktop Licensing role installed and prioritize patching for internet-exposed systems.
• Restrict network access to the licensing service to authorized RDS infrastructure only.

Patch Information

Microsoft released security updates addressing this vulnerability as part of the July 2024 Patch Tuesday cycle. Administrators should reference the Microsoft Security Advisory for CVE-2024-38072 for the specific KB articles applicable to each affected Windows Server version and install the appropriate cumulative update.

Workarounds

• Limit exposure of the Remote Desktop Licensing Service using host-based and network firewalls to allow access only from trusted RDS session hosts.
• If the licensing role is not required, remove it from servers where it is unnecessarily installed.
• Segment RDS infrastructure on isolated VLANs and block inbound licensing traffic from untrusted networks at the perimeter.

# Example: Restrict inbound access to RDS Licensing on Windows using netsh
netsh advfirewall firewall add rule name="Allow RDS Licensing - Trusted Subnet" ^
  dir=in action=allow program="%SystemRoot%\System32\lserver.exe" ^
  remoteip=10.0.0.0/24 enable=yes

netsh advfirewall firewall add rule name="Block RDS Licensing - All Other" ^
  dir=in action=block program="%SystemRoot%\System32\lserver.exe" enable=yes