CVE-2025-21379: Windows 11 24H2 DHCP Client RCE Flaw

CVE-2025-21379 Overview

CVE-2025-21379 is a remote code execution vulnerability affecting the DHCP Client Service in Microsoft Windows 11 24H2 and Windows Server 2025. This Use-After-Free (CWE-416) vulnerability allows an attacker positioned on an adjacent network to execute arbitrary code on affected systems by exploiting memory management flaws in the DHCP Client Service.

Critical Impact

An attacker on an adjacent network could leverage this vulnerability to achieve complete system compromise with high confidentiality, integrity, and availability impact on vulnerable Windows systems.

Affected Products

• Microsoft Windows 11 24H2 (ARM64)
• Microsoft Windows 11 24H2 (x64)
• Microsoft Windows Server 2025 (x64)

Discovery Timeline

• February 11, 2025 - CVE-2025-21379 published to NVD
• February 14, 2025 - Last updated in NVD database

Technical Details for CVE-2025-21379

Vulnerability Analysis

This vulnerability exists within the Windows DHCP Client Service (dhcp.sys), a critical networking component responsible for obtaining IP addresses and network configuration parameters from DHCP servers. The flaw is classified as a Use-After-Free (CWE-416) vulnerability, indicating that the service improperly manages memory during DHCP operations.

In a Use-After-Free scenario, the DHCP Client Service continues to reference memory after it has been freed, allowing an attacker to manipulate the freed memory region and potentially redirect program execution. The adjacent network attack vector means the attacker must be on the same network segment as the target system, such as the same local LAN, Wi-Fi network, or VLAN.

The vulnerability requires user interaction and involves high attack complexity, making exploitation more challenging but still feasible for sophisticated attackers in environments where they can position themselves on the local network segment.

Root Cause

The root cause of CVE-2025-21379 is improper memory lifecycle management within the DHCP Client Service. Specifically, the service fails to properly invalidate or clear references to memory objects after they have been deallocated. This Use-After-Free condition occurs when:

1. A memory object used during DHCP message processing is freed
2. The freed memory is reallocated for a different purpose
3. The original reference is subsequently accessed, leading to memory corruption

This type of vulnerability typically arises from race conditions in multi-threaded code or incorrect reference counting in complex state machines like those used in network protocol handlers.

Attack Vector

Exploitation of CVE-2025-21379 requires an attacker to be positioned on the same adjacent network as the target system. The attack could potentially involve:

1. Rogue DHCP Server Setup: The attacker establishes a malicious DHCP server on the local network segment
2. Crafted DHCP Responses: Specially crafted DHCP packets are sent to trigger the Use-After-Free condition in the target's DHCP Client Service
3. Memory Manipulation: The attacker leverages the freed memory region to inject malicious code or redirect execution flow
4. Code Execution: Successful exploitation results in arbitrary code execution in the context of the DHCP Client Service

The vulnerability requires some form of user interaction, which may involve the user connecting to a network, renewing a DHCP lease, or other network-related actions that trigger DHCP client operations.

Detection Methods for CVE-2025-21379

Indicators of Compromise

• Unexpected DHCP traffic patterns or malformed DHCP packets on the network
• Anomalous behavior from the DHCP Client Service (svchost.exe hosting dhcpsvc)
• Crash dumps or Windows Error Reporting events related to DHCP Client Service
• Unusual network connections initiated by system processes following DHCP operations

Detection Strategies

• Monitor Windows Event Logs for DHCP Client Service crashes or errors (Event ID 1001, 1000 in Application log)
• Deploy network intrusion detection rules to identify malformed DHCP packets
• Use endpoint detection and response (EDR) tools to monitor for anomalous memory operations in DHCP-related processes
• Implement SentinelOne's behavioral AI to detect exploitation attempts targeting system services

Monitoring Recommendations

• Enable enhanced logging for DHCP Client Service operations
• Configure network monitoring to alert on multiple DHCP OFFER/ACK packets from unexpected sources
• Monitor for process injection or unusual child process creation from svchost.exe hosting network services
• Implement network segmentation visibility to detect attackers positioning themselves on adjacent network segments

How to Mitigate CVE-2025-21379

Immediate Actions Required

• Apply the Microsoft security update for CVE-2025-21379 immediately on all affected Windows 11 24H2 and Windows Server 2025 systems
• Prioritize patching systems on networks where untrusted devices may be present
• Review network architecture to limit exposure of critical systems to potentially compromised network segments
• Ensure SentinelOne agents are updated to detect and prevent exploitation attempts

Patch Information

Microsoft has released security updates to address CVE-2025-21379 as part of their regular patch cycle. System administrators should consult the Microsoft Security Response Center advisory for specific patch details and affected version information.

The patch addresses the Use-After-Free condition by implementing proper memory management and reference handling within the DHCP Client Service. Organizations should deploy this update through their standard patch management processes, prioritizing systems with higher network exposure.

Workarounds

• Implement strict network segmentation to isolate critical systems from potentially compromised network segments
• Consider using static IP addressing for critical servers where DHCP is not required
• Deploy DHCP snooping on network switches to prevent rogue DHCP server attacks
• Use 802.1X network access control to limit which devices can connect to trusted network segments
• Monitor and restrict DHCP traffic using firewall rules where feasible

# PowerShell: Check DHCP Client Service status and review recent events
Get-Service -Name Dhcp | Select-Object Name, Status, StartType
Get-WinEvent -LogName System -FilterXPath "*[System[Provider[@Name='Dhcp-Client']]]" -MaxEvents 20

# PowerShell: Verify installed Windows updates
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-30) } | Sort-Object InstalledOn -Descending