CVE-2024-38063 Research – Windows IPv6 Kernel Remote Code Execution

1. Project Overview

This repository contains our research and analysis of CVE-2024-38063, a critical vulnerability in the Windows TCP/IP stack.

CVE stands for Common Vulnerabilities and Exposures. It is a standardized dictionary of publicly disclosed cybersecurity flaws maintained by the MITRE Corporation. Each entry receives a unique identifier in the format CVE-YEAR-NUMBER.

A CVSS score of 9.8 indicates an almost maximum-severity issue that requires immediate patching.

---

2. What We Did

During this research we performed the following work:

1. CVE Background Study
   Explained what a CVE is, how identifiers are assigned by MITRE, and what information a typical CVE record contains.

2. Vulnerability Characterization
   Documented why CVE-2024-38063 is considered a “holy grail” bug: no authentication, no user interaction, wormable potential, IPv6 enabled by default, and kernel-mode impact.

3. IPv6 Fundamentals
   Covered the differences between IPv4 and IPv6, the role of extension headers, and why fragmentation works differently in IPv6.

4. Deep Root-Cause Analysis
   Traced the complete packet path inside tcpip.sys:

   • How Destination Options + Fragment headers interact
   • Role of NET_BUFFER_LIST (NBL) batching
   • Behavior of Ipv6pProcessOptions and IppSendErrorList
   • Integer underflow in Ipv6pReceiveFragment
   • 16-bit allocation vs 32/64-bit copy mismatch leading to kernel heap overflow
   • Path from BSOD to possible Remote Code Execution

5. Terminology & Difficulty Assessment
   Created clear tables explaining security terms, Windows-specific concepts, and the relative difficulty of each exploitation stage.

6. Proof-of-Concept Development
   Built and documented a Scapy-based Python script that constructs the required interleaved invalid Destination Options packets and IPv6 fragments to trigger the vulnerability.

7. Complete Isolated Lab Guide
   Wrote step-by-step instructions for:

   • Setting up Kali (attacker) and unpatched Windows (target) virtual machines
   • Configuring static IPv6 addresses

---

3. Why This Vulnerability Is Critical

The bug possesses several high-risk characteristics:

• No authentication required – An attacker needs only the ability to send network packets.
• No user interaction – The victim does not need to click links, open files, or even be present.
• Wormable – A successful exploit can theoretically spread automatically from one machine to another (similar in class to EternalBlue / WannaCry).
• IPv6 enabled by default – Modern Windows systems have IPv6 active even if the network primarily uses IPv4.
• Kernel-mode impact – The flaw lives in tcpip.sys (Ring 0). Successful exploitation grants full system control.
• Complex but realistic attack vector – It is a race condition that requires precise packet timing and batching, making reliable exploitation non-trivial yet achievable by skilled attackers.

---

4. Technical Root Cause (Summary)

Trigger Components

The vulnerability is triggered by a combination of two IPv6 extension headers:

1. Destination Options Header (nh=60)
   Contains an invalid option type (otype > 0x80). This forces Windows to generate an ICMPv6 Parameter Problem error.

2. Fragment Header (nh=44)
   Keeps the packets in the IPv6 reassembly queue even after they have been corrupted.

Attack Chain

1. Attacker sends a rapid stream of interleaved invalid Destination Options packets and IPv6 fragments.
2. The packets are batched by NDIS into a single NET_BUFFER_LIST (NBL).
3. Ipv6pProcessOptions detects the bad option and hands the NBL to IppSendErrorList.
4. IppSendErrorList incorrectly sets an internal flag and corrupts subsequent packets in the same NBL, forcing their DataLength to zero.
5. Because of the Fragment header, the zero-length packets are still placed in the reassembly queue instead of being dropped.
6. Ipv6pReceiveFragment calculates payload size as 0 − HeaderSize, causing an integer underflow (payload length becomes ~4 GB).
7. A tiny buffer is allocated (16-bit size calculation truncates), but RtlCopyMemory copies the massive underflowed length → kernel heap overflow.
8. Result: Blue Screen of Death (BSOD) or, with precise control of the overflow, Remote Code Execution.

A detailed data-flow diagram and function-level analysis are available in the full write-up.

---

5. Repository Contents

Place the three supporting files in the repository root (or update the paths) so they remain linked.

---

6. Lab Safety Requirements

• Conduct all testing inside strictly isolated virtual machines (Host-Only or Internal network only).
• Never use a production machine or any system connected to the internet or corporate network.
• The target Windows system must remain unpatched (before the August 2024 cumulative update).
• Enable kernel debugging on the target (bcdedit /set debug on + reboot) to improve packet coalescing reliability.
• Disable Windows Firewall for the lab network.
• Use matching static IPv6 addresses on both attacker and target (example values used in the script: 2001:db8::20 → attacker, 2001:db8::10 → target).

Full configuration steps, troubleshooting matrix, and cleanup instructions are documented in the write-up.

---

7. Official Patch

Microsoft released the fix as part of the August 2024 Cumulative Updates:

The patch introduces proper locking around the affected code paths, eliminating the race condition that led to the integer underflow and out-of-bounds write.

---

8. Disclaimer

All materials in this repository (write-up, script, and video) are provided exclusively for educational and defensive security research.

• Do not use the Proof-of-Concept or any described techniques against systems you do not own or lack explicit authorization to test.
• Running these materials on production or internet-connected systems is illegal and unethical.
• The authors accept no responsibility for misuse or resulting damage.

---

9. References

RFC 8200: STD 86: Internet Protocol, Version 6 (IPv6) Specification

Research Team

• Mayank
• Surya Prakash
• Hiba

---