CVE-2024-38149: Windows 10 1507 BranchCache DOS Vulnerability

CVE-2024-38149 Overview

CVE-2024-38149 is a denial of service vulnerability in the Microsoft Windows BranchCache feature. The flaw allows a remote, unauthenticated attacker to exhaust resources on a target system over the network, causing service disruption. Microsoft disclosed the vulnerability as part of its October 2024 security update cycle. The issue is tracked under CWE-400 (Uncontrolled Resource Consumption) and affects a broad range of Windows client and server versions, including Windows 10, Windows 11, and Windows Server releases from 2008 through 2022.

Critical Impact
A network-adjacent attacker can trigger a denial of service condition on BranchCache-enabled Windows systems without authentication or user interaction, disrupting availability of affected services.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2012 R2, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-10-08 - CVE-2024-38149 published to NVD and addressed in Microsoft's October 2024 Patch Tuesday
2024-10-22 - Last updated in NVD database

Technical Details for CVE-2024-38149

Vulnerability Analysis

The vulnerability resides in BranchCache, a Windows feature designed to cache content from remote file and web servers on local network nodes to reduce wide area network (WAN) traffic. The flaw is classified as Uncontrolled Resource Consumption [CWE-400]. An attacker can submit crafted network requests that force BranchCache to consume excessive system resources. The result is service unavailability on the targeted host. The EPSS probability of exploitation is 2.181%, placing the issue in the 79.9th percentile relative to other CVEs.

Root Cause

The root cause stems from improper handling of resource allocation within the BranchCache service when processing inbound protocol messages. The service does not adequately bound the resources allocated in response to attacker-controlled input. Repeated or malformed requests trigger excessive consumption of memory or processing capacity, leading to denial of service.

Attack Vector

The attack is remote and requires no authentication or user interaction. An attacker with network access to a host running BranchCache can send specially crafted traffic to the BranchCache listener. Because BranchCache is commonly deployed in distributed and branch office scenarios, exposed endpoints may be reachable from broader internal network segments. Successful exploitation impacts availability only; confidentiality and integrity are not affected. See the Microsoft Security Update CVE-2024-38149 advisory for vendor details.

Detection Methods for CVE-2024-38149

Indicators of Compromise

Unexplained spikes in CPU or memory consumption by BranchCache-related processes such as PeerDistSvc
Repeated BranchCache service crashes or restarts recorded in the Windows System event log
Anomalous inbound traffic volumes to BranchCache ports, including TCP 80 (hosted cache) and WS-Discovery UDP 3702

Detection Strategies

Monitor Windows event logs for service failure events tied to the BranchCache service and correlate with network telemetry
Inspect network flows for high-frequency or malformed BranchCache protocol requests originating from unexpected sources
Establish baselines for BranchCache resource utilization and alert on sustained deviations

Monitoring Recommendations

Forward Windows Event Logs and performance counters to a centralized SIEM for correlation across endpoints
Track patch compliance status for the October 2024 Microsoft security updates across all Windows client and server assets
Review firewall and segmentation policies to identify hosts where BranchCache ports are unnecessarily exposed

How to Mitigate CVE-2024-38149

Immediate Actions Required

Apply the October 2024 Microsoft security update referenced in the Microsoft Security Update CVE-2024-38149 advisory to all affected Windows systems
Inventory hosts with BranchCache enabled and prioritize patching for internet-adjacent and branch office systems
Verify patch deployment using Windows Update for Business, WSUS, or Microsoft Configuration Manager reporting

Patch Information

Microsoft released fixes for CVE-2024-38149 in the October 8, 2024 security updates. Refer to the Microsoft Security Update CVE-2024-38149 advisory for the specific KB articles corresponding to each affected Windows version. Apply the cumulative update appropriate to the operating system build before considering any temporary workaround.

Workarounds

Disable the BranchCache service (PeerDistSvc) on hosts where the feature is not required
Restrict inbound access to BranchCache ports using host-based firewall rules and network segmentation
Limit BranchCache communication to trusted subnets via Group Policy where the feature must remain enabled

bash

# Configuration example: disable BranchCache service on hosts where it is not required
sc.exe config PeerDistSvc start= disabled
sc.exe stop PeerDistSvc

# Block external access to BranchCache hosted cache port via Windows Firewall
netsh advfirewall firewall add rule name="Block BranchCache Inbound" ^
  dir=in action=block protocol=TCP localport=80 remoteip=any