CVE-2024-38236: Windows Server 2008 DHCP DoS Vulnerability

CVE-2024-38236 Overview

CVE-2024-38236 is a denial of service vulnerability in the Microsoft Windows DHCP (Dynamic Host Configuration Protocol) Server Service. The flaw allows an unauthenticated remote attacker to exhaust resources on a vulnerable server and disrupt DHCP availability across the network. Microsoft published the advisory on September 10, 2024, and the NVD record was last updated on September 17, 2024. The vulnerability is categorized under [CWE-400] Uncontrolled Resource Consumption and affects every supported Windows Server release from Windows Server 2008 through Windows Server 2022 23H2. The EPSS model places the probability of exploitation activity at 10.03% (93rd percentile), indicating elevated risk relative to typical CVEs.

Critical Impact

A successful attack disables DHCP lease issuance and renewal, breaking automatic IP addressing for every client that depends on the affected server.

Affected Products

• Microsoft Windows Server 2008 SP2 and 2008 R2 (x86 and x64)
• Microsoft Windows Server 2012, 2012 R2, 2016, and 2019
• Microsoft Windows Server 2022 and Windows Server 2022 23H2

Discovery Timeline

• 2024-09-10 - CVE-2024-38236 published to NVD
• 2024-09-10 - Microsoft releases security update through the September 2024 Patch Tuesday cycle
• 2024-09-17 - Last updated in NVD database

Technical Details for CVE-2024-38236

Vulnerability Analysis

The vulnerability resides in the Windows DHCP Server Service, the component responsible for assigning IP addresses, gateways, and DNS settings to network clients. An attacker who can send DHCP traffic to the server can trigger uncontrolled resource consumption inside the service. Sustained exploitation forces the service into a degraded or unresponsive state. Because DHCP underpins client connectivity, the loss of the service propagates into broader network outages as existing leases expire.

The CWE-400 classification indicates that the service fails to bound resource allocation when handling specific DHCP request patterns. Microsoft's advisory confirms availability impact only, with no compromise of confidentiality or integrity.

Root Cause

The root cause is improper resource management within the DHCP Server Service when processing crafted protocol messages. The service does not enforce sufficient limits on memory, handles, or CPU cycles consumed per request, allowing a remote sender to amplify resource pressure with low-cost traffic.

Attack Vector

The attack vector is the network. Exploitation requires no authentication and no user interaction. An attacker on any network segment that can deliver DHCP packets to UDP port 67 on the server can launch the attack. In segmented environments, DHCP relay agents may expose the service to attackers outside the local broadcast domain.

No public proof-of-concept exploit code, exploit database entry, or CISA KEV listing exists for this CVE at the time of publication. Refer to the Microsoft Security Update CVE-2024-38236 for vendor technical details.

Detection Methods for CVE-2024-38236

Indicators of Compromise

• Abnormal volume of DHCPDISCOVER, DHCPREQUEST, or DHCPINFORM messages reaching a DHCP server from a small set of source MAC or IP addresses.
• DHCP Server service (DHCPServer) entering a stopped or non-responsive state, with Event ID 1056, 1059, or 1063 recorded in the System and DHCP-Server logs.
• Sudden spike in svchost.exe process memory hosting the DHCP service on the affected server.
• Client-side reports of failed lease acquisition and fallback to APIPA addresses in the 169.254.0.0/16 range.

Detection Strategies

• Baseline normal DHCP request rates per subnet and alert on deviations exceeding the baseline by a defined threshold.
• Inspect DHCP server performance counters (DHCP Server\Packets Received/sec, Active Queue Length, Conflict Check Queue Length) for sustained anomalies.
• Correlate DHCP service crashes or restarts with upstream network telemetry from switches and relay agents.

Monitoring Recommendations

• Forward Windows DHCP audit logs (%windir%\System32\dhcp\DhcpSrvLog-*.log) to a centralized SIEM for retention and analysis.
• Monitor service availability of DHCPServer with active probes and alert on restart loops.
• Enable NetFlow or sFlow on switches handling DHCP relay traffic to identify upstream sources of malformed or high-volume requests.

How to Mitigate CVE-2024-38236

Immediate Actions Required

• Apply the September 2024 Microsoft security update for every affected Windows Server build, prioritizing internet-adjacent and multi-tenant DHCP servers.
• Inventory all hosts running the DHCP Server role using Get-WindowsFeature DHCP and validate patch state with Get-HotFix.
• Restrict DHCP traffic to authorized VLANs and relay agents using access control lists on upstream switches and firewalls.
• Configure DHCP failover or split-scope deployments so a single server outage does not eliminate lease issuance for the environment.

Patch Information

Microsoft published the fix in the September 10, 2024 Patch Tuesday rollups. Administrators must install the cumulative update that matches each affected Windows Server version. The complete list of update KB numbers per product is available in the Microsoft Security Update CVE-2024-38236 advisory.

Workarounds

• Microsoft has not published an official workaround. Patching is the supported remediation path.
• As a compensating control, limit which network segments can reach UDP port 67 on the DHCP server, and disable the DHCP Server role on hosts that no longer require it.
• Enable DHCP Guard on Hyper-V virtual switches and equivalent features on physical switches to limit rogue or amplified DHCP traffic.

# Identify DHCP servers and verify patch status on Windows Server
Get-WindowsFeature -Name DHCP | Where-Object Installed -eq $true
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Restrict DHCP traffic on a Windows firewall to authorized relay agents
New-NetFirewallRule -DisplayName "Allow DHCP from Relay Agents" `
  -Direction Inbound -Protocol UDP -LocalPort 67 `
  -RemoteAddress 10.10.0.10,10.10.0.11 -Action Allow

New-NetFirewallRule -DisplayName "Block DHCP from Untrusted Sources" `
  -Direction Inbound -Protocol UDP -LocalPort 67 -Action Block