CVE-2024-38231
📋 TL;DR
This vulnerability in Windows Remote Desktop Licensing Service allows attackers to cause a denial of service by sending specially crafted packets. It affects systems running the Remote Desktop Licensing role, potentially disrupting legitimate Remote Desktop connections. Organizations using Windows Server with Remote Desktop Services are primarily affected.
💻 Affected Systems
- Windows Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete unavailability of Remote Desktop Licensing Service, preventing new Remote Desktop connections from being authorized and potentially disrupting existing sessions.
Likely Case
Service crashes requiring manual restart, causing temporary disruption to Remote Desktop licensing operations.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting exposure to the licensing service.
🎯 Exploit Status
Microsoft describes this as 'exploitation more likely' but no public exploits have been observed. The unauthenticated nature makes it easier to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: July 2024 security updates (KB5040442 for Server 2022, KB5040434 for Server 2019, KB5040430 for Server 2016)
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38231
Restart Required: Yes
Instructions:
1. Apply the July 2024 Windows Server security updates from Windows Update. 2. Restart the server to complete installation. 3. Verify the Remote Desktop Licensing Service is running normally.
🔧 Temporary Workarounds
Disable Remote Desktop Licensing Service
windowsTemporarily stop and disable the vulnerable service if not actively needed
Stop-Service -Name TermServLicensing
Set-Service -Name TermServLicensing -StartupType Disabled
Network Segmentation
windowsRestrict network access to the licensing service port (TCP 135, 445, 3389)
New-NetFirewallRule -DisplayName "Block RD Licensing" -Direction Inbound -Protocol TCP -LocalPort 135,445,3389 -Action Block
🧯 If You Can't Patch
- Implement strict network access controls to limit which systems can communicate with the Remote Desktop Licensing Service
- Monitor the TermServLicensing service for crashes and implement automated restart procedures
🔍 How to Verify
Check if Vulnerable:
Check if Remote Desktop Licensing role is installed: Get-WindowsFeature -Name RDS-Licensing. Check OS version: systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify July 2024 updates are installed: Get-HotFix -Id KB5040442, KB5040434, or KB5040430. Check service status: Get-Service TermServLicensing📡 Detection & Monitoring
Log Indicators:
- Event ID 7034 in System logs indicating TermServLicensing service terminated unexpectedly
- Multiple service crash events in short time period
Network Indicators:
- Unusual traffic patterns to TCP ports 135, 445, or 3389 from unexpected sources
- Multiple connection attempts to licensing service
SIEM Query:
source="windows" event_id=7034 service_name="TermServLicensing"