CVE-2024-38148 Overview
CVE-2024-38148 is a denial of service vulnerability in the Windows Secure Channel (Schannel) component. Schannel implements the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols on Windows. An unauthenticated attacker can send crafted network traffic to a vulnerable host and disrupt the availability of the Secure Channel service. Microsoft assigned a CVSS 3.1 base score of 7.5 to this issue. The vulnerability affects multiple supported releases of Windows 11 and Windows Server 2022. The associated weakness is classified as an out-of-bounds read [CWE-125].
Critical Impact
A remote, unauthenticated attacker can trigger a denial of service against the Windows Secure Channel component, interrupting TLS/SSL-dependent services on affected hosts.
Affected Products
- Microsoft Windows 11 (21H2, 22H2, 23H2, 24H2)
- Microsoft Windows Server 2022
- Microsoft Windows Server 2022 23H2
Discovery Timeline
- 2024-08-13 - CVE-2024-38148 published to NVD
- 2024-08-13 - Microsoft releases security update for CVE-2024-38148
- 2024-08-16 - Last updated in NVD database
Technical Details for CVE-2024-38148
Vulnerability Analysis
The vulnerability resides in the Windows Secure Channel security support provider, the component that brokers TLS and SSL sessions for Windows services. An attacker reaches the flaw over the network without authentication and without any user interaction. Successful exploitation halts the Schannel service, breaking TLS-dependent workloads such as Remote Desktop, IIS HTTPS endpoints, LDAPS, SMB over TLS, and Active Directory replication.
The Common Weakness Enumeration mapping CWE-125 indicates the root cause is an out-of-bounds read inside Schannel's protocol parsing logic. When Schannel reads beyond an allocated buffer while processing an attacker-controlled handshake message, the service terminates and refuses further connections until restarted.
The EPSS model places this CVE in the upper tail of expected exploitation activity, reflecting its network-reachable nature and the value of disrupting TLS endpoints during broader intrusions.
Root Cause
The root cause is an out-of-bounds read in Schannel's handling of TLS/SSL protocol messages. Schannel fails to validate length or offset fields in a structured field of the handshake before dereferencing memory. Reading beyond the bounds of the buffer produces an access violation that terminates the process or service hosting Schannel.
Attack Vector
The attack vector is the network. An attacker initiates a TLS/SSL handshake or sends specially crafted Schannel protocol data to any service on the target that consumes Schannel. No credentials are required and the user does not need to interact. Confidentiality and integrity remain intact, but availability of the affected service is lost until the system or service restarts and the malicious traffic stops.
No public proof-of-concept exploit code is currently available for CVE-2024-38148. Refer to the Microsoft Security Update Guide for CVE-2024-38148 for vendor technical details.
Detection Methods for CVE-2024-38148
Indicators of Compromise
- Repeated Schannel service crashes recorded in the Windows System event log with Source Schannel and unexpected process termination events.
- Application crash events (Event ID 1000) referencing lsass.exe or other Schannel-hosting processes with faulting module schannel.dll.
- Bursts of malformed TLS ClientHello or handshake records from a single source IP preceding service unavailability.
- Sudden loss of HTTPS, LDAPS, or RDP availability on unpatched Windows 11 or Windows Server 2022 hosts.
Detection Strategies
- Correlate Schannel error events with network telemetry to identify external sources sending malformed TLS handshakes.
- Inspect TLS handshake records at the network edge for oversized or malformed extensions and length fields targeting Windows endpoints.
- Alert on repeated restarts of services that depend on Schannel, such as HTTP.sys-bound IIS sites, NTDS, and TermService.
Monitoring Recommendations
- Forward Windows System and Application event logs to a central SIEM and build detections for clustered Schannel faults across hosts.
- Track baseline TLS handshake failure rates per server and alert on statistically significant deviations.
- Monitor patch compliance for Windows 11 and Windows Server 2022 systems to confirm coverage of the August 2024 security update.
How to Mitigate CVE-2024-38148
Immediate Actions Required
- Apply the August 2024 Microsoft security update that addresses CVE-2024-38148 to all affected Windows 11 and Windows Server 2022 systems.
- Prioritize internet-facing hosts that terminate TLS, including web servers, VPN gateways, and Remote Desktop Gateway servers.
- Inventory Windows endpoints by build to confirm coverage of 21H2, 22H2, 23H2, and 24H2 Windows 11 releases and both Windows Server 2022 variants.
Patch Information
Microsoft published the fix on 2024-08-13 through the Microsoft Security Update Guide. Administrators should consult the Microsoft Security Update CVE-2024-38148 advisory for the specific KB articles applicable to each affected build and deploy them through Windows Update, WSUS, or their preferred patch management tooling.
Workarounds
- Restrict inbound TLS-terminating services to trusted networks using host-based firewalls or network ACLs until patching completes.
- Place vulnerable hosts behind a TLS-terminating reverse proxy or load balancer that is not affected by CVE-2024-38148.
- Configure service recovery options so that Schannel-dependent services restart automatically if they fault, reducing outage duration while patches are staged.
# Verify the August 2024 security update is installed on Windows Server 2022
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
# Restrict inbound TLS traffic to a trusted management subnet as a temporary control
New-NetFirewallRule -DisplayName "Restrict-HTTPS-To-Mgmt" `
-Direction Inbound -Protocol TCP -LocalPort 443 `
-RemoteAddress 10.10.0.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block-HTTPS-Other" `
-Direction Inbound -Protocol TCP -LocalPort 443 `
-Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
