OnlyPatch
Windows Internet Connection Sharing (ICS)

CVE-2023-38148 — Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

Critical CVSS 8.8 EPSS 0.08176 🔬 Patch diffed 2023-09 archive

Executive Summary

None

Overview

8.8
CVSS HIGH
Critical
MS Severity
Not Exploited
MS Exploit Status
More Likely
MS Exploit Likelihood
Category Remote Code Execution
Weakness CWE-121: Stack-based Buffer Overflow
Released Sep 12 2023
Last Updated Sep 12 2023
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.08176 — 0.94357 percentile
NVD CVSS 8.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Adjacent_network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.7

EPSS Score

0.08176
probability of exploitation in the next 30 days
0.94357 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

10 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 21H2 for 32-bit Systems 5030211 (Security Update) Critical Remote Code Execution Yes
Windows 10 Version 21H2 for ARM64-based Systems 5030211 (Security Update) Critical Remote Code Execution Yes
Windows 10 Version 21H2 for x64-based Systems 5030211 (Security Update) Critical Remote Code Execution Yes
Windows 10 Version 22H2 for 32-bit Systems 5030211 (Security Update) Critical Remote Code Execution Yes
Windows 10 Version 22H2 for ARM64-based Systems 5030211 (Security Update) Critical Remote Code Execution Yes
Windows 10 Version 22H2 for x64-based Systems 5030211 (Security Update) Critical Remote Code Execution Yes
Windows 11 version 21H2 for ARM64-based Systems 5030217 (Security Update) Critical Remote Code Execution Yes
Windows 11 version 21H2 for x64-based Systems 5030217 (Security Update) Critical Remote Code Execution Yes
Windows 11 Version 22H2 for ARM64-based Systems 5030219 (Security Update) Critical Remote Code Execution Yes
Windows 11 Version 22H2 for x64-based Systems 5030219 (Security Update) Critical Remote Code Execution Yes

Patches

3 patches
Article Type Restart
5030211 Security Update Yes
5030217 Security Update Yes
5030219 Security Update Yes

Patch Diff

ghidriff · ipnathlp.dll (KB5030219)

Pre-auth stack buffer overflow (CWE-121) in the Windows Internet Connection Sharing (ICS) service ipnathlp.dll, reachable network-adjacent on the ICS DHCP server (UDP/67) with no authentication. The DHCP message processors parse the BOOTP/DHCP header whose hardware-address-length field (hlen, decompiled as param_2[0xe6]) is fully client-controlled. Downstream, DhcpAddArpEntry does memcpy(Row.PhysicalAddress, Src, hlen) where Row is a stack MIB_IPNET_ROW2 (0xA8 bytes) whose PhysicalAddress field is only 32 (0x20) bytes (IF_MAX_PHYS_ADDRESS_LENGTH). Pre-patch, Dhcp[V2]ProcessMessage only LOGGED when hlen > 0x20 and kept processing, so an attacker hlen up to 0xFF reached the memcpy and overran the stack -> controlled stack overflow -> RCE in the ICS service. IN-HOUSE ghidriff of 10.0.22621.963 -> .2283 (Sep 12 2023) confirms the fix: both DhcpProcessMessage and V2DhcpProcessMessage are restructured to `if (hlen < 0x21)` - process only when hlen <= 0x20, otherwise bail before DhcpAddArpEntry. Unconditional fix (no feature flag). Credit: Anonymous; Jarvis_1oop (@baixia4).

Pre-patch version 10.0.22621.963 Download
Post-patch version 10.0.22621.2283 Download
Function Address Change Note
V2DhcpProcessMessage 87% match code (hardware-address-length bound added, unconditional) Pre: `if (0x20 < (byte)param_2[0xe6]) { ...trace... }` then continued processing regardless. Post: gated on `if ((byte)param_2[0xe6] < 0x21)` - process only when hlen <= 0x20 (BOOTP if < 0x11, else 0x11..0x20), and hlen > 0x20 falls through to the error path (goto LAB_0) before DhcpAddArpEntry. param_2[0xe6] is the DHCP header hardware-address-length.
DhcpProcessMessage changed code (same hlen bound added) Same restructuring as V2DhcpProcessMessage: pre-patch `0x20 < hlen` only logged; post-patch gates the whole path on `hlen < 0x21` so oversized hardware-address lengths never reach the DhcpAddArpEntry memcpy sink.
DhcpAddArpEntry vulnerable sink (not modified) memcpy(Row.PhysicalAddress, Src, hlen) into a 32-byte field of the 0xA8 stack MIB_IPNET_ROW2. The fix is upstream (bound hlen in the message processors), so this sink is unchanged.
View full diff report View RCA report

Attack Path

A DHCP hardware-address-length byte over 0x20 drives a memcpy past a 32-byte stack field in the ICS DHCP server

Attack path for CVE-2023-38148 A DHCP hardware-address-length byte over 0x20 drives a memcpy past a 32-byte stack field in the ICS DHCP server 01 — ENTRY Network-adjacent attacker sends a DHCP/BOOTP packet to the ICS DHCP server (UDP/67) When Internet Connection Sharing is enabled, ipnathlp.dll runs a DHCP server on UDP/67 that parses untrusted packets pre-authentication. Any host on the shared segment can send to it. 02 — CONTROLLED INPUT Sets the DHCP header hardware-address-length (hlen) field greater than 0x20 hlen is a single client-controlled header byte (up to 0xFF). Legitimate clients use 6 (Ethernet); the attacker sets it large. 03 — PATH Dhcp/V2DhcpProcessMessage processes the message and reaches DhcpAddArpEntry The message processor validates hlen only weakly (pre-patch it merely logged hlen > 0x20 and continued), then DhcpAddArpEntry builds a stack MIB_IPNET_ROW2 and copies the client hardware address in. 04 — MISSING CHECK hlen used as a memcpy length into a 32-byte stack field, unbounded memcpy(Row.PhysicalAddress, Src, hlen) where PhysicalAddress is 0x20 bytes. With hlen up to 0xFF, the copy overruns the field on the stack (Row is 0xA8; the copy runs past PhysicalAddress) - CWE-121. 05 — PRIMITIVE Controlled stack buffer overflow in the ICS service -> pre-auth RCE Attacker-controlled hardware-address bytes overwrite the stack of the ICS process, giving remote code execution (Critical). The Sept 2023 fix bounds hlen to <= 0x20 in both message processors before the sink; unconditional, no feature flag.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

Anonymous
Jarvis_1oop

On This Page