CVE-2024-43447: Windows Server 2022 SMBv3 RCE Vulnerability

CVE-2024-43447 Overview

CVE-2024-43447 is a remote code execution vulnerability in the Windows SMBv3 server component of Microsoft Windows Server 2022. The flaw is rooted in a double free condition [CWE-415] within the SMBv3 server's handling of network requests. An unauthenticated remote attacker who successfully exploits this issue can execute arbitrary code in the context of the SMB service. Microsoft published the advisory on November 12, 2024, as part of its monthly security updates. The vulnerability requires no privileges and no user interaction, although the attack complexity is high because successful exploitation depends on winning a memory state race.

Critical Impact
Successful exploitation grants an unauthenticated remote attacker the ability to execute arbitrary code on Windows Server 2022 systems exposing SMBv3 over the network.

Affected Products

Microsoft Windows Server 2022
Systems running the SMBv3 server role
Any Windows Server 2022 host with TCP port 445 reachable by untrusted networks

Discovery Timeline

2024-11-12 - Microsoft releases security advisory for CVE-2024-43447
2024-11-12 - CVE-2024-43447 published to the National Vulnerability Database (NVD)
2024-11-19 - Last updated in the NVD database

Technical Details for CVE-2024-43447

Vulnerability Analysis

The vulnerability resides in the Windows SMBv3 server implementation and is classified as a double free condition [CWE-415]. A double free occurs when the same memory region is released to the heap allocator twice, corrupting allocator metadata and creating exploitable primitives. In the SMBv3 server, the flaw is triggered through crafted Server Message Block (SMB) network traffic that drives the server into freeing the same object across overlapping code paths. Exploitation produces memory corruption that an attacker can shape into a write-what-where primitive and ultimately into remote code execution. Because the SMB service runs in a privileged context, successful exploitation results in execution at high privilege on the target host.

Root Cause

The root cause is improper lifecycle management of an internal SMBv3 server object. Concurrent or sequenced request handlers release the same allocation more than once, leading to heap allocator corruption. The high attack complexity reflects the need to time the request sequence so the double free occurs in a controllable state.

Attack Vector

The vulnerability is reachable over the network through the SMBv3 protocol, typically on TCP port 445. No authentication and no user interaction are required. An attacker sends a sequence of crafted SMB requests to a vulnerable Windows Server 2022 host to trigger the double free and pivot from heap corruption to code execution. No public proof-of-concept code is referenced in the advisory at the time of publication.

No verified exploit code is available for this CVE. See the Microsoft CVE-2024-43447 Advisory for vendor technical details.

Detection Methods for CVE-2024-43447

Indicators of Compromise

Unexpected lsass.exe or System process crashes correlated with inbound SMB traffic on TCP port 445
Anomalous SMB session activity from external or untrusted source addresses to Windows Server 2022 hosts
New or unexpected child processes spawned by the SMB server worker after handling remote SMB requests
Heap corruption events in Windows Error Reporting (WER) records referencing the SMB driver srv2.sys

Detection Strategies

Monitor for SMB protocol anomalies, including malformed packets, repeated session setup failures, and unusual command sequences targeting SMBv3.
Alert on outbound network connections initiated by SMB service processes, which would indicate post-exploitation activity.
Correlate kernel crash dumps referencing srv2.sys with preceding inbound SMB sessions to identify exploitation attempts.

Monitoring Recommendations

Enable SMB auditing through Group Policy and forward Microsoft-Windows-SMBServer/Operational event logs to a centralized log platform.
Track network telemetry for TCP port 445 traffic from networks that should not require SMB access, particularly internet-facing interfaces.
Watch for repeated client disconnections or session resets in SMB server logs that may indicate fuzzing or exploitation attempts.

How to Mitigate CVE-2024-43447

Immediate Actions Required

Apply the November 2024 Microsoft security update for Windows Server 2022 referenced in the Microsoft CVE-2024-43447 Advisory.
Inventory all Windows Server 2022 systems exposing SMB to verify patch coverage.
Block TCP port 445 inbound at the network perimeter and restrict it to trusted management subnets internally.
Disable SMBv3 on hosts that do not require file or print sharing services.

Patch Information

Microsoft addressed CVE-2024-43447 in the November 12, 2024 security update cycle for Windows Server 2022. Administrators should consult the Microsoft CVE-2024-43447 Advisory for the specific KB article and cumulative update applicable to their build. Patching is the only complete remediation for the underlying double free condition.

Workarounds

Restrict SMB access using host-based firewall rules limiting TCP port 445 to known internal clients.
Segment SMB-enabled servers into isolated VLANs and require VPN access for administrative connectivity.
Enable SMB signing and require encryption to harden the SMB attack surface, recognizing this does not eliminate the underlying flaw.
Disable the SMB server service (LanmanServer) on hosts that do not need to share files.

bash

# Configuration example: disable SMBv3 server on a host that does not require it
Set-SmbServerConfiguration -EnableSMB2Protocol $false -Force

# Restrict inbound SMB to trusted management subnet only
New-NetFirewallRule -DisplayName "Block SMB Inbound" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block
New-NetFirewallRule -DisplayName "Allow SMB from Mgmt" -Direction Inbound -Protocol TCP -LocalPort 445 -RemoteAddress 10.10.0.0/24 -Action Allow