Critical Zero-Click RCE in Microsoft Windows TCP/IP CVE-2024-38063

CVE-2024-38063 is a critical remote code execution (RCE) vulnerability within the Microsoft Windows TCP/IP driver (tcpip.sys). The flaw is triggered by specially crafted IPv6 packets containing malformed Hop-by-Hop extension headers, leading to an integer/buffer overflow during packet processing. Because the vulnerability resides at the kernel level and requires no user interaction, it allows unauthenticated attackers to achieve SYSTEM-level code execution. This zero-click vector enables potential wormable exploitation across IPv6-enabled networks, posing a severe risk of full system compromise, lateral movement, and data exfiltration. Immediate application of Microsoft's August 2024 security updates is mandatory to remediate the driver flaw.

• Vulnerability Mechanics: Kernel-Level Overflow
• Root cause involves an integer/buffer overflow when parsing malformed IPv6 Hop-by-Hop options within the tcpip.sys kernel module.
• Exploitation allows attackers to overwrite kernel memory addresses, granting arbitrary code execution with SYSTEM privileges.

• The vulnerability requires only an IPv6-enabled network interface and necessitates no prior authentication or user interaction.

• Impact and Exploitation Potential

• CVSS v3.1 base score is estimated at 9.8 (Critical), reflecting high impact and extremely low attack complexity.
• High wormable potential enables self-propagating malware to spread across segmented enterprise networks via IPv6.

• Threat actors are likely to weaponize this vulnerability for ransomware deployment, state-sponsored espionage, or large-scale botnet recruitment.

• Detection and Mitigation Strategies

• Primary remediation: Deploy Microsoft's August 2024 security updates to patch the vulnerable tcpip.sys driver.
• Network-level defense: Implement IDS/IPS signatures specifically targeting anomalous IPv6 extension header structures or irregular packet lengths.

• Attack surface reduction: Disable IPv6 on non-essential interfaces or enforce strict network segmentation to restrict IPv6 traffic to trusted zones.

• Security Research and Intelligence

• Technical deep-dives by Wiz, SentinelOne, and OPSWAT highlight the severity of the driver-level memory corruption.
• Industry advisories from H-ISAC emphasize the risk to critical infrastructure and healthcare sectors using IPv6-enabled systems.
• Continuous monitoring for irregular IPv6 packet structures is recommended for early detection of exploitation attempts.