Developers Create Proof of Concept for Windows IPv6 Vulnerability, Paralyzing Devices with Specially Crafted Packets

Recently, a critical security vulnerability was identified in Windows 10/11 and Windows Server systems, located within the IPv6 network stack. This vulnerability allows attackers to trigger remote code execution by simply sending specially crafted packets to the target device, requiring no interaction from the user.

Given its potential for remote code execution and the lack of need for user interaction, the severity of this vulnerability is evidently high. Microsoft has already addressed this issue in the security update released in August, and users can immunize themselves against this vulnerability by installing the patch.

In the security bulletin, Microsoft emphasized that there was no evidence of the vulnerability being exploited by hackers. However, Microsoft also acknowledged that, given the nature of this vulnerability, it was inevitable that someone would find a way to exploit it. And now, that time has come.

On GitHub, developers have released a Proof of Concept (PoC) for this vulnerability. The existence of a PoC means that developers have figured out the basic method of exploiting the vulnerability, paving the way for further exploitation possibilities.

Developer @Ynwarcs stated that the current PoC code is quite unstable, but the simplest way to replicate the vulnerability is to use it on the target system with bcdedit /set debug on and then restart the target system or virtual machine.

This operation will enable the default network card driver, kdnic.sys, which is "very willing" to cooperate with the specially crafted packets. To replicate the vulnerability in different settings, the target system needs to be in a position where it can merge the sent packets.

The script provided by the developer also includes several fields to choose from, the most important of which is the target system's IPv6 address. Additionally, sending multiple batches of different packets increases the likelihood of causing stack issues and triggering the vulnerability.

Project address: https://github.com/ynwarcs/CVE-2024-38063

If your network environment provides an IPv6 address, make sure to install all the latest security updates on all Windows systems to patch the vulnerability. If it's temporarily impossible to install the updates, consider disabling the IPv6 settings in the network and using only IPv4 addresses.

Moreover, configuring the Windows Firewall cannot block attacks triggered by this vulnerability because the database is triggered before reaching the firewall. Therefore, setting up the firewall to filter IPv6 inbound and outbound traffic is ineffective.