CVE-2024-38145: Windows 10 1507 DOS Vulnerability

CVE-2024-38145 Overview

CVE-2024-38145 is a denial of service vulnerability affecting the Windows Layer-2 Bridge Network Driver. The flaw stems from a null pointer dereference [CWE-476] in the kernel-mode driver that handles Layer-2 bridge networking. A remote, unauthenticated attacker can send crafted network traffic to trigger the condition and crash the affected system. Microsoft addressed the issue in its August 2024 Patch Tuesday release.

The vulnerability impacts a broad range of supported Windows client and server platforms. While it does not enable code execution or information disclosure, successful exploitation produces a system-level outage on the targeted host.

Critical Impact
Network-reachable, unauthenticated attackers can crash affected Windows systems and disrupt availability without user interaction.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (21H2, 22H2, 23H2, 24H2)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-08-13 - Microsoft publishes the security advisory and patch
2024-08-13 - CVE-2024-38145 published to NVD
2024-08-16 - Last updated in NVD database

Technical Details for CVE-2024-38145

Vulnerability Analysis

The vulnerability resides in the Windows Layer-2 Bridge Network Driver, a kernel-mode component that forwards Ethernet frames between bridged network interfaces. The driver fails to validate an internal pointer before dereferencing it during the processing of specific Layer-2 frames. When the pointer is null, the kernel triggers a bug check and the host crashes.

The attack vector is network-based and requires no privileges or user interaction. Exploitation produces a high-impact availability outcome but does not affect confidentiality or integrity. The vulnerability cannot be used to execute code or read memory contents.

This class of kernel driver flaw is significant in bridged or virtualized environments. Hyper-V hosts, container hosts, and systems sharing network interfaces with virtual machines often enable Layer-2 bridging, expanding the practical attack surface.

Root Cause

The root cause is a null pointer dereference [CWE-476] within the bridge driver. A code path that processes incoming bridged frames assumes a referenced structure is initialized but does not verify the pointer prior to use. Specially crafted traffic causes the driver to follow this path with an uninitialized or freed pointer, resulting in an unhandled kernel exception.

Attack Vector

An attacker on an adjacent or reachable network segment sends crafted Layer-2 frames to a host running the bridge driver in an active configuration. Because the flaw is reached during normal frame processing, the attacker does not need credentials or prior access. Microsoft has not published technical exploitation details, and no public proof-of-concept code is available at the time of this writing. See the Microsoft Security Advisory for CVE-2024-38145 for vendor guidance.

Detection Methods for CVE-2024-38145

Indicators of Compromise

Unexpected BSOD events with stop codes referencing the bridge driver or network stack components
System reboots correlated with bursts of malformed Layer-2 traffic on bridged interfaces
Repeated crash dumps generated on Hyper-V hosts or systems with active network bridging

Detection Strategies

Monitor the Windows System event log for BugCheck events (Event ID 1001) and correlate with network traffic captures at the time of the crash
Inspect kernel minidumps for faulting modules associated with Layer-2 bridge functionality
Alert on repeated unplanned restarts of hosts that have the Network Bridge feature enabled

Monitoring Recommendations

Inventory Windows hosts with the Network Bridge feature enabled and prioritize them for patch verification
Capture network telemetry on segments connected to bridged hosts to identify anomalous Layer-2 frame patterns
Track patch deployment status of the August 2024 Microsoft security updates across all in-scope endpoints and servers

How to Mitigate CVE-2024-38145

Immediate Actions Required

Apply the August 2024 Microsoft security updates to all affected Windows client and server versions
Identify systems with active Layer-2 bridges and prioritize them in the patch rollout
Restrict Layer-2 access to bridged hosts using network segmentation and switch-level controls

Patch Information

Microsoft released fixes for CVE-2024-38145 as part of the August 13, 2024 security update cycle. Patch identifiers vary by Windows version. Refer to the Microsoft Security Advisory for CVE-2024-38145 for the specific KB articles applicable to each supported build.

Workarounds

Disable the Windows Network Bridge feature on hosts that do not require it
Apply Layer-2 filtering on adjacent switches to block untrusted devices from sending traffic to bridged interfaces
Isolate Hyper-V and container hosts on dedicated VLANs to limit exposure to untrusted endpoints

bash

# Configuration example: identify and remove an existing network bridge on Windows
Get-NetAdapter | Where-Object { $_.InterfaceDescription -like "*Bridge*" }
Remove-NetLbfoTeam -Name "Network Bridge" -Confirm:$false