Microsoft urges customers to patch critical Windows TCP/IP bugs

Microsoft has urged customers today to install security updates for three Windows TCP/IP vulnerabilities rated as critical and high severity as soon as possible.

This warning was issued due to elevated exploitation risk and potential denial-of-service (DoS) attacks that could soon target these bugs.

The three TCP/IP security vulnerabilities impact computers running Windows client and server versions starting with Windows 7 and higher.

They are all exploitable remote by unauthenticated attackers and are tracked as CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086.

Two of them expose unpatched systems to remote code execution (RCE) attacks, while the third one enables attackers to trigger a DoS state, taking down the targeted device.

"The DoS exploits for these CVEs would allow a remote attacker to cause a stop error. Customers might receive a blue screen on any Windows system that is directly exposed to the internet with minimal network traffic," the Microsoft Security Response Center team said.

"The two RCE vulnerabilities are complex which make it difficult to create functional exploits, so they are not likely in the short term.

"We believe attackers will be able to create DoS exploits much more quickly and expect all three issues might be exploited with a DoS attack shortly after release. Thus, we recommend customers move quickly to apply Windows security updates this month."

Windows TCP/IP vulnerabilities:

- Internal find at Microsoft
- Not exploited in wild
- Exploit creation for RCE is very difficult
- Pre-patch workaround is deny Source Routing, which is disallowed by default

CVE-2021-24074 CVE-2021-24094 CVE-2021-24086https://t.co/WJLhzqwRVp

— Kevin Beaumont (@GossiTheDog) February 9, 2021

Workarounds also available

While Microsoft says that it is vital to apply today's security updates on all Windows devices as soon as possible, the company also provides workarounds for those who can't immediately deploy them.

Redmond provides separate Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) solutions for these security issues.

The IPv4 workaround requires hardening against the use of Source Routing, normally disallowed in Windows default state.

Detailed instructions available in the CVE-2021-24074 advisory can be applied either via Group Policy or by running a NETSH command that will not require restarting the patched machine. 

The IPv6 workarounds require blocking IPv6 fragments which, unfortunately, may negatively impact services with IPv6 dependencies — info on how to apply them is available in the CVE-2021-24094 and CVE-2021-24086 advisories.

"IPv4 Source Routing requests and IPv6 fragments can be blocked on an edge device, such as a load balancer or a firewall," Microsoft also noted.

"This option can be used to mitigate systems with high-risk exposure and then allow the systems to be patched following their standard cadence."