CVE-2024-43642 Overview
CVE-2024-43642 is a denial of service vulnerability in the Windows Server Message Block (SMB) implementation. The flaw stems from a use-after-free condition [CWE-416] in the SMB stack and affects Windows 11 and Windows Server 2022/2025 releases. Microsoft addressed the issue in the November 2024 security updates.
A remote, unauthenticated attacker can exploit the issue over the network by sending crafted SMB traffic to a vulnerable host. Successful exploitation causes loss of availability on the targeted system. The EPSS percentile for this CVE sits in the top tier, indicating elevated likelihood of exploitation activity relative to other CVEs.
Critical Impact
Remote, unauthenticated attackers can trigger a denial of service against Windows SMB services, disrupting file sharing and dependent business operations.
Affected Products
- Microsoft Windows 11 (versions 22H2, 23H2, 24H2) on x64 and ARM64
- Microsoft Windows Server 2022 and Windows Server 2022 23H2
- Microsoft Windows Server 2025
Discovery Timeline
- 2024-11-12 - CVE-2024-43642 published to NVD and addressed in Microsoft's November Patch Tuesday
- 2024-11-18 - Last updated in NVD database
Technical Details for CVE-2024-43642
Vulnerability Analysis
The vulnerability resides in the Windows SMB server implementation, which handles file, printer, and named-pipe sharing over TCP port 445. Microsoft classifies the issue as a denial of service, and MITRE assigns CWE-416 (Use After Free) as the underlying weakness class.
Use-after-free conditions occur when code references memory that has already been released. In a kernel-mode protocol stack like srv2.sys, dereferencing a freed object during request processing can corrupt internal state and crash the host. The result on an SMB server is typically a bugcheck or service-level failure that interrupts client sessions.
The attack is network-reachable, requires no authentication, and needs no user interaction. Exploitation impacts availability only; the advisory does not indicate confidentiality or integrity loss.
Root Cause
The root cause is improper object lifetime management within the SMB request handling path. A specially shaped SMB message causes the server to access a structure after it has been freed, leading to memory corruption that the kernel cannot safely recover from.
Attack Vector
An unauthenticated attacker with network access to TCP port 445 sends a malformed sequence of SMB packets to the target. Internet-exposed SMB endpoints are at highest risk, but internal pivoting from a compromised workstation is the more realistic exploitation path given common firewall postures.
No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. Technical specifics are described in prose only; see the Microsoft Security Update CVE-2024-43642 advisory for vendor detail.
Detection Methods for CVE-2024-43642
Indicators of Compromise
- Unexpected SYSTEM_SERVICE_EXCEPTION or KERNEL_MODE_HEAP_CORRUPTION bugchecks referencing srv2.sys or mrxsmb.sys in memory dumps
- Repeated SMB session resets or abrupt TCP RST traffic on port 445 originating from a single external or internal source
- Windows Event Log entries from source Server or SMBServer indicating abnormal termination of the LanmanServer service
Detection Strategies
- Monitor for crash events tied to SMB kernel components and correlate them with preceding inbound SMB traffic from non-trusted hosts
- Inspect SMB negotiation and session-setup traffic for malformed headers, oversized fields, or non-standard command sequences using network sensors
- Alert on bursts of SMB connection attempts to port 445 followed by host unresponsiveness or reboot events
Monitoring Recommendations
- Enable SMB auditing via Audit Detailed File Share and forward Windows Event IDs 1020 and 1021 to a central log platform
- Track host availability metrics on file servers and domain controllers so SMB-induced outages surface quickly
- Capture full packet data for traffic destined to port 445 on critical servers to support post-incident analysis
How to Mitigate CVE-2024-43642
Immediate Actions Required
- Apply the November 2024 Microsoft security updates to all affected Windows 11 and Windows Server builds listed in the advisory
- Block inbound TCP port 445 at the network perimeter and restrict SMB exposure to authenticated management segments
- Inventory internet-facing hosts with SMB enabled and prioritize them for patching first
Patch Information
Microsoft released fixes through the November 12, 2024 update cycle. Refer to the Microsoft Security Update CVE-2024-43642 page for the specific KB articles that map to each affected build.
Workarounds
- Restrict SMB traffic to trusted subnets using host-based firewall rules and network access control lists
- Disable SMB on systems that do not require file or printer sharing using Set-SmbServerConfiguration -EnableSMB1Protocol $false and equivalent controls for SMBv2/v3 where applicable
- Require SMB signing and encryption to limit the attack surface for unauthenticated network peers
# Configuration example: block inbound SMB on a Windows host until patches are deployed
New-NetFirewallRule -DisplayName "Block-Inbound-SMB-445" -Direction Inbound -Action Block -Protocol TCP -LocalPort 445
Set-SmbServerConfiguration -EncryptData $true -RequireSecuritySignature $true -Confirm:$false
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
