Windows TCP/IP 远程代码执行
漏洞介绍
漏洞CVE-2024-38063是存在于Windows操作系统TCP/IP组件中的远程代码执行漏洞。根据微软官方介绍，该漏洞最高严重等级为严重，CVSS 评分为 9.8，Windows 系统的多个版本受此漏洞影响。攻击者可利用该漏洞实现远程代码执行。
漏洞原理
漏洞成因在于 Windows 操作系统 TCP/IP 组件中存在整数下溢漏洞，未经身份验证的攻击者可重复向 Windows 计算机发送 IPv6 数据包（包括特别构建的数据包），从而实现远程代码执行。
影响版本
影响版本
Windows 11Version24H2for x64-based Systems
Windows11Version24H2for ARM64-based Systems
WindowsServer2012 R2 (ServerCore installation)
WindowsServer2012 R2
WindowsServer2012(ServerCore installation)
WindowsServer2012
WindowsServer2008 R2 for x64-based SystemsServicePack1(ServerCore installation)
WindowsServer2008 R2 for x64-based SystemsServicePack1
WindowsServer2008for x64-based SystemsServicePack2(ServerCore installation)
WindowsServer2008for x64-based SystemsServicePack2
WindowsServer2008for32-bit SystemsServicePack2(ServerCore installation)
WindowsServer2008for32-bit SystemsServicePack2
WindowsServer2016(ServerCore installation)
WindowsServer2016
Windows10Version1607for x64-based Systems
Windows10Version1607for32-bit Systems
Windows10for x64-based Systems
Windows10for32-bit Systems
WindowsServer2022,23H2Edition(ServerCore installation)
Windows11Version23H2for x64-based Systems
Windows11Version23H2for ARM64-based Systems
Windows10Version22H2for32-bit Systems
Windows10Version22H2for ARM64-based Systems
Windows10Version22H2for x64-based Systems
Windows11Version22H2for x64-based Systems
Windows11Version22H2for ARM64-based Systems
Windows10Version21H2for x64-based Systems
Windows10Version21H2for ARM64-based Systems
Windows10Version21H2for32-bit Systems
Windows11 version 21H2for ARM64-based Systems
Windows11 version 21H2for x64-based Systems
WindowsServer2022(ServerCore installation)
WindowsServer2022
WindowsServer2019(ServerCore installation)
WindowsServer2019
Windows10Version1809for ARM64-based Systems
Windows10Version1809for x64-based Systems
Windows10Version1809for32-bit System修复建议：
1）临时修复：
1. 打开“
设置”>“网络和互联网”>“以太网”或“Wi-Fi”；2. 点击您的网络连接；
3. 向下滚动，点击“
编辑”按钮；4. 在弹出窗口中选择“
禁用”IPv6选项；5. 点击“
保存”即可。
2）永久修复：
下载补丁升级
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063
