CVE-2024-38073: Windows Server 2008 DOS Vulnerability

CVE-2024-38073 Overview

CVE-2024-38073 is a denial of service vulnerability in the Windows Remote Desktop Licensing Service. The flaw affects multiple Microsoft Windows Server versions, from Windows Server 2008 through Windows Server 2022 23H2. An unauthenticated remote attacker can send crafted network traffic to the licensing service and disrupt its availability. The vulnerability is categorized under [CWE-125] (Out-of-Bounds Read), indicating that the service reads memory outside the bounds of a buffer when processing attacker-supplied input. Microsoft addressed the issue in the July 2024 Patch Tuesday release.

Critical Impact

An unauthenticated, network-based attacker can crash the Remote Desktop Licensing Service, preventing Remote Desktop Services clients from obtaining or renewing licenses across affected Windows Server hosts.

Affected Products

• Microsoft Windows Server 2008 (SP2 x86/x64) and Windows Server 2008 R2 SP1
• Microsoft Windows Server 2012 and 2012 R2
• Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• 2024-07-09 - Microsoft publishes the security update for CVE-2024-38073
• 2024-07-09 - CVE-2024-38073 published to the National Vulnerability Database
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-38073

Vulnerability Analysis

The vulnerability resides in the Remote Desktop Licensing Service, a component that issues and tracks Remote Desktop Services client access licenses (RDS CALs). The service listens on the network and processes license-related requests from RDS session hosts and clients. CWE-125 classification indicates the service performs an out-of-bounds read while parsing a malformed request. The flaw permits an attacker on the network to trigger the read without authentication or user interaction. Successful exploitation halts license issuance and renewal, blocking new RDS sessions on environments that depend on per-user or per-device licensing.

Root Cause

The root cause is an out-of-bounds read [CWE-125] in the parsing logic of the Remote Desktop Licensing Service. The service does not adequately validate the size or structure of attacker-controlled fields before indexing into a memory buffer. Reading past the allocated bounds returns invalid data or triggers an access violation, terminating the service process.

Attack Vector

The attack vector is network-based with low complexity and no privileges required. An attacker sends a malformed licensing protocol request to a server exposing the Remote Desktop Licensing role, typically over TCP. Because no authentication is needed, the service can be attacked directly from any host that can reach the licensing listener. Microsoft's advisory does not describe code execution as a consequence — impact is limited to availability of the licensing service. See the Microsoft Security Update Guide for CVE-2024-38073 for vendor-specific technical detail.

No verified proof-of-concept exploit code is publicly available for this vulnerability. The exploitation mechanism involves transmitting a malformed licensing request that drives the service into reading attacker-influenced offsets outside an allocated buffer, terminating the lserver.dll-hosted service.

Detection Methods for CVE-2024-38073

Indicators of Compromise

• Unexpected termination or repeated restarts of the Remote Desktop Licensing Service (TermServLicensing) on affected Windows Server hosts.
• Windows Event Log entries showing service crashes referencing lserver.dll or faulting modules associated with RDS licensing.
• RDS session hosts reporting failure to obtain or renew client access licenses after a burst of inbound traffic to the licensing server.
• Anomalous inbound TCP connections to the RDS licensing port from untrusted network segments.

Detection Strategies

• Monitor Windows Service Control Manager events (Event IDs 7031, 7034) for crashes of TermServLicensing.
• Alert on Windows Error Reporting and application crash events naming the licensing service binaries.
• Correlate inbound network flows to licensing hosts with subsequent service-stop events to identify external trigger sources.

Monitoring Recommendations

• Inventory all servers carrying the Remote Desktop Licensing role and ensure they report to centralized logging.
• Track patch state of windows_server_* hosts against Microsoft's July 2024 cumulative updates.
• Baseline normal traffic volumes to the RDS licensing service so that anomalous spikes are surfaced promptly.

How to Mitigate CVE-2024-38073

Immediate Actions Required

• Apply the Microsoft July 2024 security updates to every affected Windows Server host that carries the Remote Desktop Licensing role.
• Restrict network access to the licensing service so only authorized RDS session hosts can reach it.
• Audit perimeter firewalls to confirm RDS licensing ports are not reachable from the internet.

Patch Information

Microsoft released fixes for CVE-2024-38073 in the July 9, 2024 security update cycle. Patch availability and KB article numbers for each affected Windows Server version are listed in the Microsoft Security Update Guide. Administrators should apply the cumulative update corresponding to their server build and reboot to complete installation.

Workarounds

• If patching must be delayed, block inbound traffic to the Remote Desktop Licensing Service at the network firewall and Windows Defender Firewall, allowing only known RDS session hosts.
• Stop and disable the Remote Desktop Licensing role on servers that do not require it; consolidate licensing to a small number of hardened hosts.
• Segment licensing servers into a dedicated management VLAN with strict access control lists.

# Restrict inbound access to the Remote Desktop Licensing Service
# Replace <RDS_HOST_IPs> with the addresses of authorized RDS session hosts
New-NetFirewallRule -DisplayName "Restrict RDS Licensing - Allow Known Hosts" `
  -Direction Inbound -Action Allow -Protocol TCP `
  -Service TermServLicensing -RemoteAddress <RDS_HOST_IPs>

New-NetFirewallRule -DisplayName "Restrict RDS Licensing - Block Others" `
  -Direction Inbound -Action Block -Protocol TCP `
  -Service TermServLicensing -RemoteAddress Any