CVE-2023-36435: Microsoft QUIC Denial of Service Vulnerability
CVE-2023-36435 is a denial of service vulnerability in Microsoft QUIC, rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 5.72% probability of exploitation activity in the next 30 days, higher than 93% of all scored vulnerabilities. Microsoft released the fix on 10 October 2023 in the October 2023 Patch Tuesday, delivered through 4 security updates (KB5031364, KB5031358, KB5031354, KB5032875). It affects 8 products in 2 product families (Developer Tools, Windows).
Key facts
- CVE ID
- CVE-2023-36435
- Severity
- High CVSS 7.5
- Microsoft severity
- Important
- Impact
- Denial of Service
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-400
- EPSS
- 5.72% (percentile 93%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- October 2023 Patch Tuesday
- Product families
- Developer Tools, Windows
CVSS score and vector
Microsoft scores CVE-2023-36435 at 7.5 (temporal 6.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | None |
| Integrity impact | None |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Frequently asked questions (Microsoft)
Where can I find more information?
Please see the GitHub Advisory relating to this vulnerability here: https://github.com/microsoft/msquic/security/advisories/GHSA-fr44-546p-7xcp#event-111622
Affected products (8)
Developer Tools
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| PowerShell 7.3 | Release Notes | Security Update | 7.3.9 | Maybe |
| .NET 7.0 | KB5032875 | Security Update | 7.0.13 | Maybe |
Windows
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Windows Server 2022 | KB5031364 | Security Update | 10.0.20348.2031 | Yes |
| Windows Server 2022 (Server Core installation) | KB5031364 | Security Update | 10.0.20348.2031 | Yes |
| Windows 11 version 21H2 for x64-based Systems | KB5031358 | Security Update | 10.0.22000.2538 | Yes |
| Windows 11 version 21H2 for ARM64-based Systems | KB5031358 | Security Update | 10.0.22000.2538 | Yes |
| Windows 11 Version 22H2 for ARM64-based Systems | KB5031354 | Security Update | 10.0.22621.2428 | Yes |
| Windows 11 Version 22H2 for x64-based Systems | KB5031354 | Security Update | 10.0.22621.2428 | Yes |
Security updates (4)
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 7.5 (HIGH)
- NVD weakness
- CWE-400
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| .net | from 7.0.0, up to and including 7.0.12 |
| windows 11 21h2 | before 10.0.22000.2538 |
| windows 11 22h2 | before 10.0.22621.2428 |
| windows server 2022 | all listed versions |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36435 (Patch, Vendor Advisory)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36435 (Patch, Vendor Advisory)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 2.0 | Revised the Security Updates table to include PowerShell 7.3 because this version of PowerShell 7 is affected by this vulnerability. See https://github.com/PowerShell/Announcements/issues/52 for more information. | |
| 3.0 | To comprehensively address CVE-2023-36435, Microsoft has released security updates on October 24, 2023 for .NET 7.0. Microsoft recommends that customers running .NET install the updates to be fully protected from the vulnerability. |