HighPublic exploit

Windows TCP/IP IPv6 Fragment Reassembly NULL Pointer Dereference DoS

IdentifiersCVE-2021-24086CWE-476

CVE-2021-24086 is a denial-of-service vulnerability in the Windows TCP/IP stack, specifically in the tcpip.sys driver during reassembly of fragmented IPv6 packets. The flaw is rooted in a NULL pointer dereference in the IPv6 fragment reassembly logic, identified in the function Ipv6pReassembleDatagram. A remote attacker can trigger the vulnerable code path by sending crafted fragmented IPv6 traffic to a target Windows system, causing the kernel network stack to dereference a NULL pointer while processing the malformed packet sequence.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation causes a denial of service in the Windows kernel networking stack. The likely result is a system crash or bugcheck, interrupting network services and potentially taking the affected host offline until it is restarted. The available information characterizes this issue as DoS rather than remote code execution.

Mitigation

If you can’t patch tonight, do this now.

Where immediate patching is not possible, reduce exposure by limiting untrusted IPv6 traffic to affected systems, especially fragmented IPv6 packets, through network filtering or perimeter controls where operationally feasible. Disable or restrict IPv6 only if it is not required and after validating operational impact. These measures are compensating controls and do not replace vendor patching.

Remediation

Patch, then assume compromise.

Apply the Microsoft security updates released for CVE-2021-24086 as part of the Windows monthly security fixes addressing TCP/IP stack vulnerabilities. Prompt patching is recommended because denial-of-service exploit development was assessed as comparatively straightforward.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app

CVE-2021-24086MaturityPoCVerified exploit

This repository contains a proof-of-concept (PoC) exploit for CVE-2021-24086, a remotely triggerable denial of service vulnerability in the Windows TCP/IP stack (tcpip.sys) affecting IPv6. The main exploit script, 'cve-2021-24086.py', is written in Python and uses the Scapy library to craft and send a series of fragmented IPv6 UDP packets with oversized extension headers to a specified target. The default target is the IPv6 multicast address 'ff02::1', but this can be changed via command-line arguments. The exploit aims to trigger a NULL dereference in the Windows kernel, causing a system crash. The repository also includes a README with background information, usage instructions, and references to further technical analysis. The exploit is a PoC and does not provide post-exploitation capabilities or a customizable payload; its sole purpose is to demonstrate the vulnerability by crashing the target system.

0vercl0kDisclosed Apr 7, 2021pythonnetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindows 10operating_system

Microsoft CorporationWindows 7operating_system

Microsoft CorporationWindows 8.1operating_system

Microsoft CorporationWindows Rt 8.1operating_system

Microsoft CorporationWindows Server 2008operating_system

Microsoft CorporationWindows Server 2012operating_system

Microsoft CorporationWindows Server 2016operating_system

Microsoft CorporationWindows Server 2019operating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

malwaretech blogNews

Aug 27, 2024

CVE-2024-38063 - Remotely Exploiting The Kernel Via IPv6

A previously disclosed Windows tcpip.sys IPv6 fragmentation vulnerability referenced for historical context while analyzing a newer tcpip.sys IPv6 options-related bug.

palo alto networks unit 42 blogNews

Feb 17, 2021

WatchDog: Exposing a Cryptojacking Campaign That’s Operated for Two Years

A Windows IPv4/IPv6 stack vulnerability mentioned only in a 'Next' article link, not discussed in the WatchDog content.

mcafee labsNews

Feb 9, 2021

Researchers Follow the Breadcrumbs: The Latest Vulnerabilities in Windows' Network Stack

A denial-of-service vulnerability in Windows tcpip.sys triggered by malformed IPv6 packet reassembly, leading to a persistent system crash (Blue Screen of Death).

msrc blog microsoftNews

Feb 9, 2021

Multiple Security Updates Affecting TCP/IP: CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086

An important denial of service vulnerability in the Windows TCP/IP implementation.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity