CVE-2024-38119: Windows 10 1507 NAT RCE Vulnerability

CVE-2024-38119 Overview

CVE-2024-38119 is a remote code execution vulnerability in the Windows Network Address Translation (NAT) component. The flaw is rooted in a use-after-free condition [CWE-416] in the NAT driver that processes network traffic on systems where Windows NAT is enabled, including Routing and Remote Access Service (RRAS) and Internet Connection Sharing (ICS) hosts. An adjacent network attacker who wins a race condition can corrupt memory and execute arbitrary code in the context of the affected service. Microsoft addressed the issue in the September 2024 Patch Tuesday release.

Critical Impact

Successful exploitation can lead to arbitrary code execution on Windows hosts running NAT services, exposing internal network segments behind the NAT boundary to compromise.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H1, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2, 23H2, 24H2)
• Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• 2024-09-10 - CVE-2024-38119 published to NVD and addressed in Microsoft's September 2024 security update
• 2024-09-17 - Last updated in NVD database

Technical Details for CVE-2024-38119

Vulnerability Analysis

The vulnerability resides in the Windows NAT driver responsible for translating addresses between internal and external network interfaces. Microsoft classifies the flaw under [CWE-416] (Use After Free), indicating that the driver references memory after it has been freed. An attacker on an adjacent network segment can craft packets that traverse the NAT engine in a sequence that triggers the dangling pointer.

The attack complexity is rated high because exploitation depends on winning a race condition inside the kernel-mode NAT component. When successful, the corruption yields control over freed memory structures, which an attacker can use to achieve code execution within the privileged service handling NAT traffic.

Root Cause

The root cause is improper lifecycle management of a memory object inside the NAT driver. The driver releases an object while another execution path still holds a reference, then dereferences that stale pointer during subsequent packet processing. This pattern is characteristic of use-after-free conditions in kernel networking stacks.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be on the same logical network as the vulnerable host or on a network segment that the NAT host bridges. No authentication or user interaction is required. The attacker sends a crafted sequence of packets through the NAT interface, racing internal cleanup logic to trigger the use-after-free condition.

// No verified public proof-of-concept code is available for CVE-2024-38119.
// Refer to the Microsoft Security Response Center advisory for technical guidance:
// https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38119

Detection Methods for CVE-2024-38119

Indicators of Compromise

• Unexpected crashes, bugchecks, or memory faults in services associated with Windows NAT, RRAS, or Internet Connection Sharing
• Anomalous inbound traffic patterns targeting hosts acting as NAT gateways from adjacent network segments
• New or unexplained child processes spawned by services running under SYSTEM on NAT-enabled hosts

Detection Strategies

• Monitor Windows Event Logs for crashes referencing ipnat.sys, RRAS, or ICS components on systems performing NAT functions
• Inspect packet captures at the NAT boundary for malformed or anomalously sequenced traffic that does not match expected client flows
• Apply behavioral detection on NAT hosts to identify post-exploitation activity such as credential access, lateral movement, or persistence following service crashes

Monitoring Recommendations

• Inventory all Windows hosts where RRAS, ICS, or NAT roles are enabled and apply elevated monitoring to those systems
• Forward Windows Defender, system, and security logs from NAT hosts to a centralized data lake for correlation
• Use Singularity Endpoint behavioral AI to surface anomalous activity originating from kernel-mode networking services on monitored Windows hosts

How to Mitigate CVE-2024-38119

Immediate Actions Required

• Apply the September 2024 Microsoft security updates to all affected Windows 10, Windows 11, and Windows Server systems
• Identify and prioritize patching on hosts where the NAT role, RRAS, or Internet Connection Sharing is enabled
• Restrict adjacent network access to NAT-enabled hosts through segmentation and access control lists

Patch Information

Microsoft published the fix in its September 10, 2024 security update cycle. Patch details and per-build update references are available in the Microsoft CVE-2024-38119 Advisory. Administrators should consult the advisory to match the correct cumulative update or security-only package to each Windows build in their environment.

Workarounds

• Disable the NAT, RRAS, or Internet Connection Sharing roles on hosts where they are not required for business operations
• Place NAT hosts on dedicated, tightly controlled network segments to limit adjacent network exposure
• Enforce host-based firewall rules that restrict which adjacent endpoints can reach the NAT interface

# Example: list and disable the Routing and Remote Access service on a Windows host
sc.exe query RemoteAccess
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess