CVE-2023-38043
📋 TL;DR
This vulnerability in Ivanti Secure Access Client allows locally authenticated attackers to exploit a misconfiguration, potentially causing denial of service on user machines and in worst cases leading to full system compromise. All versions below 22.6R1.1 are affected, requiring local access to the target system.
💻 Affected Systems
- Ivanti Secure Access Client
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary kernel function calls, allowing complete control over the affected machine.
Likely Case
Denial of service condition on user workstations, disrupting VPN connectivity and potentially requiring system reboot.
If Mitigated
Limited impact with proper access controls and monitoring, potentially only service disruption.
🎯 Exploit Status
Requires local access and knowledge of vulnerable configuration exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 22.6R1.1 and later
Vendor Advisory: https://forums.ivanti.com/s/article/Security-fixes-included-in-the-latest-Ivanti-Secure-Access-Client-Release
Restart Required: Yes
Instructions:
1. Download Ivanti Secure Access Client version 22.6R1.1 or later from official Ivanti portal. 2. Uninstall previous version. 3. Install updated version. 4. Restart the system.
🔧 Temporary Workarounds
Restrict Local Access
allLimit local user access to systems running Ivanti Secure Access Client to reduce attack surface.
Monitor for Suspicious Activity
allImplement enhanced monitoring for Ivanti client processes and kernel interactions.
🧯 If You Can't Patch
- Implement strict local access controls and least privilege principles
- Monitor systems for unusual Ivanti client behavior or crash events
🔍 How to Verify
Check if Vulnerable:
Check Ivanti Secure Access Client version in application settings or via 'About' menu.Check Version:
On Windows: Check program version in Control Panel > Programs and Features. On Linux/macOS: Check application version in GUI or via package manager.Verify Fix Applied:
Verify version is 22.6R1.1 or higher in application settings.📡 Detection & Monitoring
Log Indicators:
- Unexpected Ivanti client crashes
- Kernel access violations
- Unusual local authentication patterns
Network Indicators:
- Sudden VPN disconnections
- Unusual local network traffic from Ivanti processes
SIEM Query:
source="*ivanti*" AND (event_type="crash" OR event_type="privilege_escalation")🔗 References
- https://forums.ivanti.com/s/article/Security-fixes-included-in-the-latest-Ivanti-Secure-Access-Client-Release
- https://northwave-cybersecurity.com/vulnerability-notice/arbitrary-kernel-function-call-in-ivanti-secure-access-client
- https://forums.ivanti.com/s/article/Security-fixes-included-in-the-latest-Ivanti-Secure-Access-Client-Release
- https://northwave-cybersecurity.com/vulnerability-notice/arbitrary-kernel-function-call-in-ivanti-secure-access-client
