Cloudanix VulnDB

CVE-2024-38229

High · 8.1

Microsoft Security Advisory CVE-2024-38229 | .NET Remote Code Execution Vulnerability

CVSS

8.1

EPSS

2.1%

Published

Oct 8, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A timing bug in Microsoft .NET web software can let remote attackers interfere with newer internet connections, potentially crashing or seizing control of applications.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
Web Framework
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in ASP.NET HTTP/3 stream handling during concurrent close and response body write operations leads to use-after-free memory access in .NET 8.0 and 9.0.

Why it matters to the business

Remote attackers may crash or potentially hijack .NET web applications that use HTTP/3, causing downtime, data exposure, or full system compromise in affected services.

How an attack unfolds

An attacker establishes an HTTP/3 connection to a vulnerable .NET application, then issues requests that force simultaneous stream closure and writes to the response body, triggering the race condition to corrupt memory or execute arbitrary code.

How to fix it

Upgrade affected .NET 8.0 and 9.0 installations to versions containing commit cbc9971f29b95d0b47a2ad272305ea4af300b1fb. For .NET 6.0 users of experimental HTTP/3, upgrade to 8.0.10 or later. Disable HTTP/3 where not required until patched.

How to confirm the fix worked

Verify deployed .NET runtime versions against the fixed commit hash, enable HTTP/3 logging, and perform targeted load tests that close streams during active response writes to confirm absence of crashes or memory errors.

Typical attack path

  1. Establish HTTP/3 connection to target .NET application
  2. Send requests that trigger concurrent stream close and response writes
  3. Exploit resulting use-after-free for memory corruption or code execution
  4. Escalate to application takeover or denial of service

How to detect it

Review application logs and process dumps for HTTP/3 stream handling errors, unexpected memory faults, or crashes in dotnet processes during response operations; correlate with network traffic showing rapid stream open/close patterns.

What your security team should do

  • Immediately apply the referenced commit or patched .NET releases to all production and development environments
  • Audit applications for HTTP/3 usage and prioritize upgrades based on exposure
  • Monitor for memory-related crashes in ASP.NET processes and review EPSS trends for changes
  • Consider temporary HTTP/3 disablement in configuration until patches are deployed

The record

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free. Note: HTTP/3 is experimental in .NET 6.0. If you are on .NET 6.0 and using HTTP/3, please upgrade to .NET 8.0.10. .NET 6.0 will not receive a security patch for this vulnerability.

Affected packages

Ecosystem Package Introduced Fixed
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm 8.0.0 8.0.10
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 8.0.0 8.0.10
NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm 8.0.0 8.0.10
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 8.0.0 8.0.10
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 8.0.0 8.0.10
NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-x64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 8.0.0 8.0.10
NuGet Microsoft.AspNetCore.App.Runtime.linux-x64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
NuGet Microsoft.AspNetCore.App.Runtime.osx-arm64 8.0.0 8.0.10
NuGet Microsoft.AspNetCore.App.Runtime.osx-arm64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 8.0.0 8.0.10
NuGet Microsoft.AspNetCore.App.Runtime.osx-x64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
NuGet Microsoft.AspNetCore.App.Runtime.win-arm 8.0.0 8.0.10
NuGet Microsoft.AspNetCore.App.Runtime.win-arm 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 8.0.0 8.0.10
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 8.0.0 8.0.10
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 8.0.0 8.0.10
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
AlmaLinux:8 aspnetcore-runtime-8.0 0 8.0.10-1.el8_10
AlmaLinux:8 aspnetcore-runtime-dbg-8.0 0 8.0.10-1.el8_10
AlmaLinux:8 aspnetcore-targeting-pack-8.0 0 8.0.10-1.el8_10
AlmaLinux:8 dotnet 0 8.0.110-1.el8_10
AlmaLinux:8 dotnet-apphost-pack-8.0 0 8.0.10-1.el8_10
AlmaLinux:8 dotnet-host 0 8.0.10-1.el8_10
AlmaLinux:8 dotnet-hostfxr-8.0 0 8.0.10-1.el8_10
AlmaLinux:8 dotnet-runtime-8.0 0 8.0.10-1.el8_10
AlmaLinux:8 dotnet-runtime-dbg-8.0 0 8.0.10-1.el8_10
AlmaLinux:8 dotnet-sdk-8.0 0 8.0.110-1.el8_10
AlmaLinux:8 dotnet-sdk-8.0-source-built-artifacts 0 8.0.110-1.el8_10
AlmaLinux:8 dotnet-sdk-dbg-8.0 0 8.0.110-1.el8_10
AlmaLinux:8 dotnet-targeting-pack-8.0 0 8.0.10-1.el8_10
AlmaLinux:8 dotnet-templates-8.0 0 8.0.110-1.el8_10
AlmaLinux:8 netstandard-targeting-pack-2.1 0 8.0.110-1.el8_10
AlmaLinux:9 aspnetcore-runtime-8.0 0 8.0.10-1.el9_4
AlmaLinux:9 aspnetcore-runtime-dbg-8.0 0 8.0.10-1.el9_4
AlmaLinux:9 aspnetcore-targeting-pack-8.0 0 8.0.10-1.el9_4
AlmaLinux:9 dotnet-apphost-pack-8.0 0 8.0.10-1.el9_4
AlmaLinux:9 dotnet-host 0 8.0.10-1.el9_4
AlmaLinux:9 dotnet-hostfxr-8.0 0 8.0.10-1.el9_4
AlmaLinux:9 dotnet-runtime-8.0 0 8.0.10-1.el9_4
AlmaLinux:9 dotnet-runtime-dbg-8.0 0 8.0.10-1.el9_4
AlmaLinux:9 dotnet-sdk-8.0 0 8.0.110-1.el9_4
AlmaLinux:9 dotnet-sdk-8.0-source-built-artifacts 0 8.0.110-1.el9_4
AlmaLinux:9 dotnet-sdk-dbg-8.0 0 8.0.110-1.el9_4
AlmaLinux:9 dotnet-targeting-pack-8.0 0 8.0.10-1.el9_4
AlmaLinux:9 dotnet-templates-8.0 0 8.0.110-1.el9_4
AlmaLinux:9 netstandard-targeting-pack-2.1 0 8.0.110-1.el9_4
Bitnami dotnet 8.0.0 8.0.10
Bitnami dotnet-sdk 8.0.0 8.0.10
Red Hat:enterprise_linux:8::appstream aspnetcore-runtime-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream aspnetcore-runtime-dbg-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream aspnetcore-targeting-pack-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-apphost-pack-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-apphost-pack-8.0-debuginfo 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-host 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-host-debuginfo 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-hostfxr-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-hostfxr-8.0-debuginfo 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-runtime-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-runtime-8.0-debuginfo 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-runtime-dbg-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-sdk-8.0 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-sdk-8.0-debuginfo 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-sdk-8.0-source-built-artifacts 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-sdk-dbg-8.0 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-targeting-pack-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet-templates-8.0 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet8.0 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet8.0-debuginfo 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::appstream dotnet8.0-debugsource 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::appstream netstandard-targeting-pack-2.1 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::crb aspnetcore-runtime-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb aspnetcore-runtime-dbg-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb aspnetcore-targeting-pack-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-apphost-pack-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-apphost-pack-8.0-debuginfo 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-host 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-host-debuginfo 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-hostfxr-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-hostfxr-8.0-debuginfo 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-runtime-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-runtime-8.0-debuginfo 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-runtime-dbg-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-sdk-8.0 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-sdk-8.0-debuginfo 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-sdk-8.0-source-built-artifacts 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-sdk-dbg-8.0 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-targeting-pack-8.0 0 0:8.0.10-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet-templates-8.0 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet8.0 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet8.0-debuginfo 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::crb dotnet8.0-debugsource 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:8::crb netstandard-targeting-pack-2.1 0 0:8.0.110-1.el8_10
Red Hat:enterprise_linux:9::appstream aspnetcore-runtime-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream aspnetcore-runtime-dbg-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream aspnetcore-targeting-pack-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-apphost-pack-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-apphost-pack-8.0-debuginfo 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-host 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-host-debuginfo 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-hostfxr-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-hostfxr-8.0-debuginfo 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-runtime-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-runtime-8.0-debuginfo 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-runtime-dbg-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-sdk-8.0 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-sdk-8.0-debuginfo 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-sdk-8.0-source-built-artifacts 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-sdk-dbg-8.0 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-targeting-pack-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet-templates-8.0 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet8.0 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet8.0-debuginfo 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::appstream dotnet8.0-debugsource 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::appstream netstandard-targeting-pack-2.1 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::crb aspnetcore-runtime-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb aspnetcore-runtime-dbg-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb aspnetcore-targeting-pack-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-apphost-pack-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-apphost-pack-8.0-debuginfo 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-host 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-host-debuginfo 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-hostfxr-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-hostfxr-8.0-debuginfo 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-runtime-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-runtime-8.0-debuginfo 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-runtime-dbg-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-sdk-8.0 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-sdk-8.0-debuginfo 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-sdk-8.0-source-built-artifacts 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-sdk-dbg-8.0 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-targeting-pack-8.0 0 0:8.0.10-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet-templates-8.0 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet8.0 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet8.0-debuginfo 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::crb dotnet8.0-debugsource 0 0:8.0.110-1.el9_4
Red Hat:enterprise_linux:9::crb netstandard-targeting-pack-2.1 0 0:8.0.110-1.el9_4
Rocky Linux:8 dotnet8.0 0 0:8.0.110-1.el8_10
Rocky Linux:9 dotnet8.0 0 0:8.0.110-1.el9_4
Ubuntu:22.04:LTS dotnet6 0 6.0.135-0ubuntu1~22.04.1
Ubuntu:22.04:LTS dotnet7 0 No fix
Ubuntu:22.04:LTS dotnet8 0 8.0.110-8.0.10-0ubuntu1~22.04.1
Ubuntu:24.04:LTS dotnet8 0 8.0.110-8.0.10-0ubuntu1~24.04.1
Ubuntu:24.10 dotnet8 0 8.0.110-8.0.10-0ubuntu1
Ubuntu:24.10 dotnet9 0 No fix
nuget Microsoft.AspNetCore.App.Runtime.linux-arm 8.0.0 8.0.10
nuget Microsoft.AspNetCore.App.Runtime.linux-arm 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64 8.0.0 8.0.10
nuget Microsoft.AspNetCore.App.Runtime.linux-arm64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm 8.0.0 8.0.10
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 8.0.0 8.0.10
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64 8.0.0 8.0.10
nuget Microsoft.AspNetCore.App.Runtime.linux-musl-x64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
nuget Microsoft.AspNetCore.App.Runtime.linux-x64 8.0.0 8.0.10
nuget Microsoft.AspNetCore.App.Runtime.linux-x64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
nuget Microsoft.AspNetCore.App.Runtime.osx-arm64 8.0.0 8.0.10
nuget Microsoft.AspNetCore.App.Runtime.osx-arm64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
nuget Microsoft.AspNetCore.App.Runtime.osx-x64 8.0.0 8.0.10
nuget Microsoft.AspNetCore.App.Runtime.osx-x64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
nuget Microsoft.AspNetCore.App.Runtime.win-arm 8.0.0 8.0.10
nuget Microsoft.AspNetCore.App.Runtime.win-arm 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
nuget Microsoft.AspNetCore.App.Runtime.win-arm64 8.0.0 8.0.10
nuget Microsoft.AspNetCore.App.Runtime.win-arm64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
nuget Microsoft.AspNetCore.App.Runtime.win-x64 8.0.0 8.0.10
nuget Microsoft.AspNetCore.App.Runtime.win-x64 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3
nuget Microsoft.AspNetCore.App.Runtime.win-x86 8.0.0 8.0.10
nuget Microsoft.AspNetCore.App.Runtime.win-x86 9.0.0-preview.1.24081.5 9.0.0-rc.2.24474.3

Related vulnerabilities