Microsoft has issued an urgent security update to mitigate a significant remote code execution vulnerability identified in the Windows TCP/IP stack. This flaw, designated as CVE-2024-38063, poses a critical risk to all supported versions of Windows and Windows Server, including Server Core installations.
Understanding CVE-2024-38063
CVE-2024-38063 has been assigned a maximum severity rating of Critical, with a CVSSv3 score of 9.8. The vulnerability’s key characteristics are as follows:
- An attacker can exploit this vulnerability remotely by sending specially crafted IPv6 packets to a targeted host.
- No user interaction is necessary, categorizing this as a “0-click” vulnerability.
- The exploitation is exclusively possible through IPv6 packets.
Microsoft has classified the likelihood of exploitation as “Exploitation More Likely.” Successful exploitation of CVE-2024-38063 could enable an attacker to execute arbitrary code on the affected system with SYSTEM privileges, granting them complete control over the compromised machine. According to Microsoft, “An unauthenticated attacker could repeatedly send IPv6 packets, including specially crafted packets, to a Windows machine, potentially enabling remote code execution.”
Affected Systems and Immediate Actions
The vulnerability affects all supported versions of:
- Windows
- Windows Server (including Server Core installations)
In response, Microsoft has rolled out patches for all impacted versions of Windows and Windows Server. Organizations are strongly encouraged to implement these updates without delay. As a precautionary measure, Microsoft advises disabling IPv6 if it is not essential, as the vulnerability can only be exploited through IPv6 packets. Additionally, Microsoft has addressed six Zero-Days that threat actors are actively exploiting in the wild.
Mitigations and Recommendations
Security experts recommend the following actions to safeguard systems:
- Immediately apply the latest Microsoft security updates.
- Prioritize patching internet-facing systems.
- Consider disabling IPv6 if it is not required in your environment.
- Monitor for any suspicious network activity, particularly involving IPv6 traffic.
- Implement network segmentation to limit potential lateral movement in the event of a system compromise.
Given the critical nature of this vulnerability and its potential for widespread impact, organizations should prioritize addressing CVE-2024-38063 as an urgent matter.
Looking Ahead: Copilot+ Devices and Windows 11
Microsoft also noted that the new Copilot+ devices, now publicly available, come pre-installed with Windows 11, version 24H2. Customers utilizing these devices should remain vigilant regarding vulnerabilities affecting their systems and ensure that updates are installed, especially if automatic updates are not enabled. The general availability date for Windows 11, version 24H2 is anticipated later this year.
