Critical Zero-Click RCE in Microsoft Windows TCP/IP CVE-2024-38063

CVE-2024-38063 is a critical remote code execution (RCE) vulnerability within the Microsoft Windows TCP/IP driver (tcpip.sys). The flaw is triggered by specially crafted IPv6 packets containing malformed Hop-by-Hop extension headers, leading to an integer/buffer overflow during packet processing. Because the vulnerability resides at the kernel level and requires no user interaction, it allows unauthenticated attackers to achieve SYSTEM-level code execution. This zero-click vector enables potential wormable exploitation across IPv6-enabled networks, posing a severe risk of full system compromise, lateral movement, and data exfiltration. Immediate application of Microsoft's August 2024 security updates is mandatory to remediate the driver flaw.

• Vulnerability Mechanics: Kernel-Level Overflow

  • Root cause involves an integer/buffer overflow when parsing malformed IPv6 Hop-by-Hop options within the tcpip.sys kernel module.
  • Exploitation allows attackers to overwrite kernel memory addresses, granting arbitrary code execution with SYSTEM privileges.
  • The vulnerability requires only an IPv6-enabled network interface and necessitates no prior authentication or user interaction.

• Impact and Exploitation Potential

  • CVSS v3.1 base score is estimated at 9.8 (Critical), reflecting high impact and extremely low attack complexity.
  • High wormable potential enables self-propagating malware to spread across segmented enterprise networks via IPv6.
  • Threat actors are likely to weaponize this vulnerability for ransomware deployment, state-sponsored espionage, or large-scale botnet recruitment.

• Detection and Mitigation Strategies

  • Primary remediation: Deploy Microsoft's August 2024 security updates to patch the vulnerable tcpip.sys driver.
  • Network-level defense: Implement IDS/IPS signatures specifically targeting anomalous IPv6 extension header structures or irregular packet lengths.
  • Attack surface reduction: Disable IPv6 on non-essential interfaces or enforce strict network segmentation to restrict IPv6 traffic to trusted zones.

• Security Research and Intelligence

  • Technical deep-dives by Wiz, SentinelOne, and OPSWAT highlight the severity of the driver-level memory corruption.
  • Industry advisories from H-ISAC emphasize the risk to critical infrastructure and healthcare sectors using IPv6-enabled systems.
  • Continuous monitoring for irregular IPv6 packet structures is recommended for early detection of exploitation attempts.