Skip to content
This repository has been archived by the owner on Dec 27, 2023. It is now read-only.
/ CVE-2021-24086 Public archive

Proof of concept for CVE-2021-24086, a NULL dereference in tcpip.sys triggered remotely.

License

Notifications You must be signed in to change notification settings

0vercl0k/CVE-2021-24086

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

6 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

CVE-2021-24086

This is a proof of concept for CVE-2021-24086 ("Windows TCP/IP Denial of Service Vulnerability "), a NULL dereference in tcpip.sys patched by Microsoft in February 2021. According to this tweet, the vulnerability has been found by @piazzt. It is triggerable remotely by sending malicious UDP packet over IPv6.

trigger

You can read Microsoft's blog here: Multiple Security Updates Affecting TCP/IP:  CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086. It discusses briefly the impact and workaround/mitigations.

A more in-depth discussion about the root-cause is available on doar-e.github.io: Reverse-engineering tcpip.sys: mechanics of a packet of the death (CVE-2021-24086).

doare

Running the PoC

Run the cve-2021-24086.py script; it requires Scapy:

over@bubuntu:~$ sudo python3 cve-2021-24086.py
66 fragments, total size 0xfff8
..................................................................
Sent 66 packets.
.
Sent 1 packets.

Authors

About

Proof of concept for CVE-2021-24086, a NULL dereference in tcpip.sys triggered remotely.

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages