^{CVE-2021-24074:}Windows TCP/IP Remote Code Execution Vulnerability (CVE-2021-24074)

Overview

This vulnerability affects the Windows TCP/IP stack and is considered critical due to its potential for remote code execution. The issue stems from improper validation of IPv4 packets with source routing options. An unauthenticated attacker could exploit this vulnerability by sending specially crafted IPv4 packets to a target system, potentially gaining the ability to execute arbitrary code in the context of the kernel. The vulnerability affects multiple versions of Windows operating systems and could lead to a complete system compromise. Microsoft has assigned this vulnerability a CVSS base score of 9.8 (Critical).

Remediation

To mitigate this vulnerability, Microsoft strongly recommends applying the security updates released in February 2021 Security Update. If patching is not immediately possible, the following temporary mitigations can be implemented:

1. Block inbound IPv4 packets with source routing options at the perimeter firewall
2. Run the following PowerShell command to block these packets at the Windows host: netsh int ipv4 set global sourceroutingbehavior=drop
3. Disable IPv4 source routing by setting the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableIPSourceRouting = 2
4. Consider implementing network segmentation to isolate affected systems until patching is possible

References

1. Microsoft Security Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24074
2. Microsoft Security Response Center Blog: https://msrc-blog.microsoft.com/2021/02/09/multiple-security-updates-affecting-tcp-ip/
3. Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24074
4. NIST National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2021-24074
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog