CVE-2023-21722: .NET Framework Denial of Service Vulnerability

Overview

Severity

Medium (CVSS 5)

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Category

Denial of Service

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2023-Feb

Released

2023-02-14

Last Updated

2023-03-29

EPSS Score

0.40% (percentile: 60.6%)

FAQ

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability? Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is Denial of Service? The attack itself is carried out locally. For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website. This could lead to a local attack on the victim's computer which could cause a denial of service.

Affected Products (71)

Developer Tools

• Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Microsoft .NET Framework 4.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Microsoft .NET Framework 4.8 on Windows Server 2012
• Microsoft .NET Framework 4.8 on Windows Server 2012 (Server Core installation)
• Microsoft .NET Framework 4.8 on Windows Server 2012 R2
• Microsoft .NET Framework 4.8 on Windows Server 2012 R2 (Server Core installation)
• Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for 32-bit Systems
• Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019
• Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 (Server Core installation)
• Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022
• Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022 (Server Core installation)
• Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 20H2 for 32-bit Systems
• Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 20H2 for ARM64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8 on Windows 11 version 21H2 for x64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8 on Windows 11 version 21H2 for ARM64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 21H2 for 32-bit Systems
• Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 21H2 for ARM64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 21H2 for x64-based Systems
• Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for 32-bit Systems
• Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for x64-based Systems
• Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for ARM64-based Systems
• Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019
• Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019 (Server Core installation)
• Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012
• Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 (Server Core installation)
• Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2
• Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2 (Server Core installation)
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022 (Server Core installation)
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 20H2 for 32-bit Systems
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 20H2 for ARM64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 21H2 for x64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 21H2 for ARM64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for 32-bit Systems
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for ARM64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for x64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 22H2 for ARM64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 22H2 for x64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 22H2 for ARM64-based Systems
• Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 22H2 for 32-bit Systems
• Microsoft .NET Framework 4.6.2 on Windows Server 2008 for 32-bit Systems Service Pack 2
• Microsoft .NET Framework 4.6.2 on Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Microsoft .NET Framework 4.6.2 on Windows Server 2008 for x64-based Systems Service Pack 2
• Microsoft .NET Framework 4.6.2 on Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Microsoft .NET Framework 3.5 and 4.6.2 on Windows 10 for 32-bit Systems
• Microsoft .NET Framework 3.5 and 4.6.2 on Windows 10 for x64-based Systems
• Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2
• ... and 21 more

Security Updates (32)

• 5022731
• 5022783
• 5022732
• 5022784
• 5022733
• 5022785
• 5022782
• 5022735
• 5022727
• 5022730
• 5022782
• 5022731
• 5022783
• 5022732
• 5022784
• 5022733
• 5022785
• 5022735
• 5022727
• 5022730
• 5022497
• 5022858
• 5022734
• 5022786
• 5022732
• 5022784
• 5022733
• 5022785
• 5022731
• 5022783
• ... and 2 more

Acknowledgments

<a href="https://twitter.com/filip_dragovic">Filip Dragovic</a> with Infigo IS

Revision History

• 2023-02-14: Information published.
• 2023-03-23: Updated one or more CVSS scores for the affected products. This is an informational change only.
• 2023-03-29: Microsoft has rereleased KB5022498 to address a known issue where customers who installed the .NET Framework 4.8 February cumulative update (KB5022502), then updgraded to .NET Framework 4.8.1 and subsequently scanned for updates were unable to install KB5022498. Customers who were unable to install KB5022498 should rescan for updates and install the update. Customers who have already successfully installed KB5022498 do not need to take any further action.