CVE-2024-38128: Windows Server 2008 RRAS RCE Vulnerability

CVE-2024-38128 Overview

CVE-2024-38128 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw stems from an integer overflow or wraparound condition [CWE-190] within the RRAS component on affected Windows Server platforms. An attacker can exploit this vulnerability over the network, but successful exploitation requires user interaction. Microsoft published the advisory on August 13, 2024 as part of its scheduled security updates. The vulnerability affects multiple supported Windows Server releases from Server 2008 through Server 2022 23H2.

Critical Impact
Successful exploitation enables an attacker to execute arbitrary code on the target server, leading to complete loss of confidentiality, integrity, and availability of the affected RRAS host.

Affected Products

Microsoft Windows Server 2008 SP2 and Server 2008 R2 SP1
Microsoft Windows Server 2012 and Server 2012 R2
Microsoft Windows Server 2016, Server 2019, Server 2022, and Server 2022 23H2

Discovery Timeline

2024-08-13 - Microsoft publishes security advisory and patch for CVE-2024-38128
2024-08-13 - CVE-2024-38128 published to the National Vulnerability Database
2024-08-16 - Last updated in NVD database

Technical Details for CVE-2024-38128

Vulnerability Analysis

The vulnerability resides in the Routing and Remote Access Service, a Windows Server role that provides routing, VPN, and dial-up networking functions. The defect is classified as an integer overflow or wraparound [CWE-190] in the RRAS component. When the service processes specially crafted network input, an arithmetic operation produces a value that exceeds the expected bounds. The resulting wraparound condition leads to memory corruption that an attacker can leverage to execute arbitrary code in the context of the RRAS process.

Exploitation requires user interaction, indicating that an authorized user on the target system must perform an action such as connecting to a malicious endpoint or initiating a remote connection that triggers the vulnerable code path. No prior authentication to the target is required for the attacker.

Root Cause

The root cause is an unchecked arithmetic operation in RRAS that fails to validate size or length values before allocating or copying data. When attacker-controlled values overflow the integer type, subsequent buffer operations write outside expected boundaries. This memory corruption enables control over execution flow within the RRAS service.

Attack Vector

The attack vector is network-based with low attack complexity. An attacker crafts malicious traffic directed at a system running RRAS or convinces a user to initiate a connection that processes attacker-supplied data. Servers exposing RRAS endpoints to untrusted networks face the highest exposure. Refer to the Microsoft Security Update Guide for vendor-specific technical context.

// No verified public proof-of-concept exploit code is available for CVE-2024-38128.
// The vulnerability mechanism involves an integer overflow [CWE-190] in the
// RRAS network message processing path that leads to memory corruption and
// arbitrary code execution within the service context.

Detection Methods for CVE-2024-38128

Indicators of Compromise

Unexpected crashes, restarts, or access violations of the RemoteAccess service or svchost.exe instance hosting RRAS
Anomalous child processes spawned by the RRAS service, particularly command shells or scripting interpreters
Inbound network traffic to RRAS-related ports (PPTP TCP/1723, L2TP UDP/1701, SSTP TCP/443, IKE UDP/500) from unexpected sources
New or modified scheduled tasks, services, or registry persistence entries following RRAS activity

Detection Strategies

Inventory all Windows Servers with the Routing and Remote Access role enabled and verify patch status against the August 2024 update
Monitor Windows Event Logs for RRAS service crashes, Windows Error Reporting entries, and unusual authentication or VPN session events
Correlate process creation events (Event ID 4688 / Sysmon 1) where the parent process is associated with RRAS
Apply network IDS signatures inspecting malformed RRAS protocol traffic on VPN and routing ports

Monitoring Recommendations

Enable detailed audit logging for the RRAS role and forward logs to a centralized SIEM for correlation
Establish alerts for RRAS service restarts outside maintenance windows
Track outbound connections originating from RRAS hosts to detect post-exploitation command-and-control activity

How to Mitigate CVE-2024-38128

Immediate Actions Required

Apply the August 2024 Microsoft security updates to all Windows Server systems with the RRAS role enabled
Identify and prioritize internet-facing or perimeter RRAS hosts for immediate patching
Restrict access to RRAS service ports using host and network firewalls until patches are deployed
Review authentication logs and VPN session records for signs of attempted exploitation

Patch Information

Microsoft released patches for CVE-2024-38128 on August 13, 2024. Administrators should obtain the appropriate cumulative update for each affected Windows Server version from the Microsoft Security Update Guide. Verify installation by checking the build number and the corresponding KB article listed in the advisory.

Workarounds

Disable the Routing and Remote Access Service on servers that do not require it, removing the vulnerable code path entirely
Limit RRAS exposure with strict firewall rules that allow only known VPN client networks to reach service ports
Require strong authentication and segment RRAS servers from sensitive internal resources to contain potential compromise

bash

# PowerShell: identify and disable the RRAS role where not required
Get-WindowsFeature -Name RemoteAccess, Routing, DirectAccess-VPN

# Stop and disable the Routing and Remote Access service
Stop-Service -Name RemoteAccess -Force
Set-Service -Name RemoteAccess -StartupType Disabled

# Verify patch status by checking the installed update KB
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20