CVE-2023-36603
📋 TL;DR
CVE-2023-36603 is a Windows TCP/IP stack vulnerability that allows remote attackers to cause a denial of service (system crash/BSOD) by sending specially crafted network packets. This affects Windows systems with the vulnerable TCP/IP implementation. The vulnerability requires no authentication and can be exploited remotely.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 22h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash (Blue Screen of Death) leading to service disruption, potential data loss from unsaved work, and requiring manual reboot of affected systems.
Likely Case
Targeted systems become unresponsive or crash, causing temporary service outages until systems are rebooted, potentially affecting business operations.
If Mitigated
With proper network segmentation and firewall rules, impact is limited to isolated network segments with minimal business disruption.
🎯 Exploit Status
Microsoft has not disclosed technical details, but CVSS indicates network-accessible attack vector with low attack complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Security updates released in June 2023 Patch Tuesday
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36603
Restart Required: Yes
Instructions:
1. Apply Windows Update from June 2023 or later. 2. Install KB5027231 for Windows 10, KB5027223 for Windows 11, or corresponding Server updates. 3. Restart system after installation.
🔧 Temporary Workarounds
Network Segmentation
allIsolate vulnerable systems from untrusted networks using firewalls and network segmentation.
Windows Firewall Rules
windowsRestrict inbound TCP/IP traffic to only necessary ports and sources.
New-NetFirewallRule -DisplayName "Block Unnecessary TCP" -Direction Inbound -Protocol TCP -Action Block
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy intrusion prevention systems (IPS) with TCP/IP anomaly detection
🔍 How to Verify
Check if Vulnerable:
Check if June 2023 security updates are installed via Windows Update history or systeminfo command.Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify KB5027231 (Win10), KB5027223 (Win11), or corresponding Server updates are installed and system has been restarted.📡 Detection & Monitoring
Log Indicators:
- System event logs showing unexpected system crashes (Event ID 41)
- Blue screen crash dumps in C:\Windows\Minidump
Network Indicators:
- Unusual TCP packet patterns targeting vulnerable systems
- Multiple connection attempts to TCP ports
SIEM Query:
EventID=41 AND Source="Microsoft-Windows-Kernel-Power" AND Description contains "The system has rebooted without cleanly shutting down"