CVE-2024-35270
📋 TL;DR
This vulnerability in the Windows iSCSI service allows attackers to cause a denial of service (DoS) by sending specially crafted packets to affected systems. It affects Windows servers and workstations running vulnerable versions of the iSCSI service. Successful exploitation would cause the iSCSI service to stop responding, disrupting storage connectivity.
💻 Affected Systems
- Windows iSCSI Service
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of iSCSI storage connectivity leading to application downtime, data unavailability, and potential business impact for storage-dependent systems.
Likely Case
Temporary service disruption requiring service restart, causing brief storage connectivity loss and potential application timeouts.
If Mitigated
Minimal impact with service restart capability and no data loss or privilege escalation.
🎯 Exploit Status
Denial of service vulnerabilities typically have lower exploitation complexity. No authentication required if network access to service is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific KB numbers
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35270
Restart Required: Yes
Instructions:
1. Apply latest Windows security updates from Microsoft
2. Restart affected systems to complete installation
3. Verify iSCSI service is functioning normally
🔧 Temporary Workarounds
Network Segmentation
windowsRestrict network access to iSCSI service ports (TCP 3260) to trusted hosts only
Windows Firewall: New-NetFirewallRule -DisplayName 'Restrict iSCSI' -Direction Inbound -Protocol TCP -LocalPort 3260 -RemoteAddress TrustedIPs -Action Allow
Disable Unused iSCSI Service
windowsIf iSCSI functionality is not required, disable the service
Stop-Service MSiSCSI
Set-Service MSiSCSI -StartupType Disabled
🧯 If You Can't Patch
- Implement strict network access controls to iSCSI ports (TCP 3260)
- Monitor iSCSI service health and implement automated restart procedures
🔍 How to Verify
Check if Vulnerable:
Check Windows Update history for applied patches or use: Get-HotFix | Where-Object {$_.HotFixID -match 'KB' for relevant patch}Check Version:
systeminfo | findstr /B /C:'OS Name' /C:'OS Version'Verify Fix Applied:
Verify iSCSI service is running and check Windows version matches patched version: winver📡 Detection & Monitoring
Log Indicators:
- Event ID 7031: Service terminated unexpectedly (MSiSCSI)
- Event ID 7034: Service terminated unexpectedly
- Increased iSCSI service restart events
Network Indicators:
- Unusual traffic patterns to TCP port 3260
- Multiple connection attempts to iSCSI service
SIEM Query:
source='windows' AND (event_id=7031 OR event_id=7034) AND service_name='MSiSCSI'