CVE-2023-38171: Microsoft QUIC Denial of Service Vulnerability
First published: Tue Oct 10 2023(Updated: )
### Impact The MsQuic server application or process will crash, resulting in a denial of service. ### Patches The following patch was made: - Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343 ### Workarounds Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.
Credit: secure@microsoft.com secure@microsoft.com secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft PowerShell 7.3 | ||
| nuget/Microsoft.Native.Quic.MsQuic.OpenSSL | <2.2.3 | 2.2.3 |
| nuget/Microsoft.Native.Quic.MsQuic.Schannel | <2.2.3 | 2.2.3 |
| Microsoft Windows Server 2022 | ||
| Microsoft Windows Server 2022 | ||
| Microsoft Windows 11 | =22H2 | |
| Microsoft Windows 11 | =21H2 | |
| Microsoft Windows 11 | =22H2 | |
| Microsoft Windows 11 | =21H2 | |
| Microsoft Visual Studio 2022 | =17.6 | |
| Microsoft Visual Studio 2022 | =17.2 | |
| Microsoft Visual Studio 2022 | =17.7 | |
| Microsoft .NET 7.0 | ||
| Microsoft .NET | >=7.0.0<7.0.12 | |
| Microsoft Visual Studio 2022 | >=17.2.0<17.2.20 | |
| Microsoft Visual Studio 2022 | >=17.4.0<17.4.12 | |
| Microsoft Visual Studio 2022 | >=17.6.0<17.6.8 | |
| Microsoft Visual Studio 2022 | >=17.7.0<17.7.5 | |
| Microsoft Windows 11 22h2 | <10.0.22621.2428 | |
| Microsoft Windows Server 2022 | ||
| >=7.0.0<7.0.12 | ||
| >=17.2.0<17.2.20 | ||
| >=17.4.0<17.4.12 | ||
| >=17.6.0<17.6.8 | ||
| >=17.7.0<17.7.5 | ||
| <10.0.22621.2428 | ||
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/microsoft/msquic/security/advisories/GHSA-xh5m-8qqp-c5x7
- https://nvd.nist.gov/vuln/detail/CVE-2023-38171
- https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38171 (Advisory)
- https://github.com/advisories/GHSA-xh5m-8qqp-c5x7 (Advisory)
Frequently Asked Questions
What is CVE-2023-38171?
CVE-2023-38171 is a Microsoft QUIC Denial of Service vulnerability that can cause the MsQuic server to crash, resulting in a denial of service.
How severe is CVE-2023-38171?
CVE-2023-38171 has a severity rating of 7.5, which is considered high.
Which software products are affected by CVE-2023-38171?
Software products affected by CVE-2023-38171 include Microsoft .NET 7.0, Visual Studio 2022 (versions 17.6 and 17.7), Windows Server 2022 (Server Core Installation), Visual Studio 2022 (version 17.2), and Windows 11 (versions 22H2 and 21H2).
How can I patch CVE-2023-38171?
You can apply the necessary patches for CVE-2023-38171 by following the provided URLs for each affected software product: Microsoft .NET 7.0 (https://dotnet.microsoft.com/download/dotnet/7.0), Visual Studio 2022 (version 17.6 - https://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.6, version 17.7 - https://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.7), and Windows Server 2022 (https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5031364 for Server Core Installation).
What is the Common Weakness Enumeration (CWE) for CVE-2023-38171?
The Common Weakness Enumeration (CWE) for CVE-2023-38171 is CWE-400.
- collector/msrc
- agent/type
- agent/first-publish-date
- source/Microsoft
- collector/msrc-cve
- agent/software-canonical-lookup
- agent/title
- agent/severity
- agent/author
- agent/references
- agent/remedy
- agent/software-canonical-lookup-request
- agent/description
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-xh5m-8qqp-c5x7
- alias/CVE-2023-38171
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-cve
- collector/github-advisory
- vendor/microsoft
- canonical/microsoft powershell 7.3
- canonical/microsoft windows server 2022
- canonical/microsoft windows 11
- version/microsoft windows 11/22h2
- version/microsoft windows 11/21h2
- canonical/microsoft visual studio 2022
- version/microsoft visual studio 2022/17.6
- version/microsoft visual studio 2022/17.2
- version/microsoft visual studio 2022/17.4
- version/microsoft visual studio 2022/17.7
- canonical/microsoft .net 7.0
- canonical/microsoft .net
- version/microsoft .net/7.0.0
- version/microsoft visual studio 2022/17.2.0
- version/microsoft visual studio 2022/17.4.0
- version/microsoft visual studio 2022/17.6.0
- version/microsoft visual studio 2022/17.7.0
- canonical/microsoft windows 11 22h2
- package-manager/nuget