## https://sploitus.com/exploit?id=0A76AC0F-EAB3-5CCB-BFD6-4258204F95EF
# CVE-2024-38063 Research – Windows IPv6 Kernel Remote Code Execution
## 1. Project Overview
This repository contains our research and analysis of **CVE-2024-38063**, a critical vulnerability in the Windows TCP/IP stack.
**CVE** stands for Common Vulnerabilities and Exposures. It is a standardized dictionary of publicly disclosed cybersecurity flaws maintained by the MITRE Corporation. Each entry receives a unique identifier in the format `CVE-YEAR-NUMBER`.
| Field | Detail |
|------------------------|---------------------------------------------|
| **CVE ID** | CVE-2024-38063 |
| **Nickname** | The IPv6 Kernel Killer |
| **Severity** | Critical (CVSS 9.8 / 10) |
| **Type** | Remote Code Execution (RCE) |
| **Location** | Windows TCP/IP Stack (`tcpip.sys`) |
| **Patch Date** | August 2024 (Microsoft Patch Tuesday) |
| **Discovered By** | ZeQiao Wu (NSFOCUS TIANQI LAB) |
A CVSS score of 9.8 indicates an almost maximum-severity issue that requires immediate patching.
---
## 2. What We Did
During this research we performed the following work:
1. **CVE Background Study**
Explained what a CVE is, how identifiers are assigned by MITRE, and what information a typical CVE record contains.
2. **Vulnerability Characterization**
Documented why CVE-2024-38063 is considered a “holy grail” bug: no authentication, no user interaction, wormable potential, IPv6 enabled by default, and kernel-mode impact.
3. **IPv6 Fundamentals**
Covered the differences between IPv4 and IPv6, the role of extension headers, and why fragmentation works differently in IPv6.
4. **Deep Root-Cause Analysis**
Traced the complete packet path inside `tcpip.sys`:
- How Destination Options + Fragment headers interact
- Role of `NET_BUFFER_LIST` (NBL) batching
- Behavior of `Ipv6pProcessOptions` and `IppSendErrorList`
- Integer underflow in `Ipv6pReceiveFragment`
- 16-bit allocation vs 32/64-bit copy mismatch leading to kernel heap overflow
- Path from BSOD to possible Remote Code Execution
5. **Terminology & Difficulty Assessment**
Created clear tables explaining security terms, Windows-specific concepts, and the relative difficulty of each exploitation stage.
6. **Proof-of-Concept Development**
Built and documented a Scapy-based Python script that constructs the required interleaved invalid Destination Options packets and IPv6 fragments to trigger the vulnerability.
7. **Complete Isolated Lab Guide**
Wrote step-by-step instructions for:
- Setting up Kali (attacker) and unpatched Windows (target) virtual machines
- Configuring static IPv6 addresses
- Enabling packet coalescing with `bcdedit /set debug on`
- Disabling the firewall
- Running the PoC and verifying the Blue Screen of Death
- Troubleshooting common failures
8. **Demonstration**
Recorded a video showing the full lab setup, script execution, and successful crash.
9. **Patch Review**
Documented the official August 2024 cumulative updates (KB numbers) and how the fix eliminates the race condition.
---
## 3. Why This Vulnerability Is Critical
The bug possesses several high-risk characteristics:
- **No authentication required** – An attacker needs only the ability to send network packets.
- **No user interaction** – The victim does not need to click links, open files, or even be present.
- **Wormable** – A successful exploit can theoretically spread automatically from one machine to another (similar in class to EternalBlue / WannaCry).
- **IPv6 enabled by default** – Modern Windows systems have IPv6 active even if the network primarily uses IPv4.
- **Kernel-mode impact** – The flaw lives in `tcpip.sys` (Ring 0). Successful exploitation grants full system control.
- **Complex but realistic attack vector** – It is a race condition that requires precise packet timing and batching, making reliable exploitation non-trivial yet achievable by skilled attackers.
---
## 4. Technical Root Cause (Summary)
### Trigger Components
The vulnerability is triggered by a combination of two IPv6 extension headers:
1. **Destination Options Header (`nh=60`)**
Contains an invalid option type (`otype > 0x80`). This forces Windows to generate an ICMPv6 Parameter Problem error.
2. **Fragment Header (`nh=44`)**
Keeps the packets in the IPv6 reassembly queue even after they have been corrupted.
### Attack Chain
1. Attacker sends a rapid stream of interleaved invalid Destination Options packets and IPv6 fragments.
2. The packets are batched by NDIS into a single `NET_BUFFER_LIST` (NBL).
3. `Ipv6pProcessOptions` detects the bad option and hands the NBL to `IppSendErrorList`.
4. `IppSendErrorList` incorrectly sets an internal flag and corrupts subsequent packets in the same NBL, forcing their `DataLength` to zero.
5. Because of the Fragment header, the zero-length packets are still placed in the reassembly queue instead of being dropped.
6. `Ipv6pReceiveFragment` calculates payload size as `0 − HeaderSize`, causing an **integer underflow** (payload length becomes ~4 GB).
7. A tiny buffer is allocated (16-bit size calculation truncates), but `RtlCopyMemory` copies the massive underflowed length → **kernel heap overflow**.
8. Result: Blue Screen of Death (BSOD) or, with precise control of the overflow, Remote Code Execution.
A detailed data-flow diagram and function-level analysis are available in the full write-up.
---
## 5. Repository Contents
| File | Purpose |
|----------------------------------|--------------------------------------------------------------|
| `CVE-2024-38063_Writeup.md` | Full detailed technical analysis and complete lab guide |
| `poc_script.py` | Scapy-based Proof-of-Concept |
| `demo_video.mp4` | Video demonstration |
| `README.md` | This summary document |
Place the three supporting files in the repository root (or update the paths) so they remain linked.
---
## 6. Lab Safety Requirements
- Conduct **all** testing inside strictly isolated virtual machines (Host-Only or Internal network only).
- Never use a production machine or any system connected to the internet or corporate network.
- The target Windows system must remain **unpatched** (before the August 2024 cumulative update).
- Enable kernel debugging on the target (`bcdedit /set debug on` + reboot) to improve packet coalescing reliability.
- Disable Windows Firewall for the lab network.
- Use matching static IPv6 addresses on both attacker and target (example values used in the script: `2001:db8::20` → attacker, `2001:db8::10` → target).
Full configuration steps, troubleshooting matrix, and cleanup instructions are documented in the write-up.
---
## 7. Official Patch
Microsoft released the fix as part of the August 2024 Cumulative Updates:
| Operating System | KB Number |
|------------------------|-------------|
| Windows 11 | KB5041580 |
| Windows 10 | KB5041583 |
| Windows Server 2022 | KB5041581 |
| Windows Server 2019 | KB5041579 |
The patch introduces proper locking around the affected code paths, eliminating the race condition that led to the integer underflow and out-of-bounds write.
---
## 8. Disclaimer
All materials in this repository (write-up, script, and video) are provided **exclusively for educational and defensive security research**.
- Do not use the Proof-of-Concept or any described techniques against systems you do not own or lack explicit authorization to test.
- Running these materials on production or internet-connected systems is illegal and unethical.
- The authors accept no responsibility for misuse or resulting damage.
---
## 10. References
**Research Team**
- Mayank
- Surya Prakash
- Hiba
---