Microsoft Security Advisory CVE-2024-38229 | .NET Remote Code Execution Vulnerability
Date: 2024-10
Affected: nuget/Microsoft.AspNetCore.App.Runtime.win-x86, nuget/Microsoft.AspNetCore.App.Runtime.win-x86, nuget/Microsoft.AspNetCore.App.Runtime.win-x64
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-38229
CWE: CWE-362
CWE-416
CVSS: 7.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

# Microsoft Security Advisory CVE-2024-38229 | .NET Remote Code Execution Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free. Note: HTTP/3 is experimental in .NET 6.0. If you are on .NET 6.0 and using HTTP/3, please upgrade to .NET 8.0.10. .NET 6.0 will not receive a security patch for this vulnerability. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/326 ## <a name="mitigation-factors"></a>Mitigation factors HTTP/3 support is not enabled by default in ASP.NET Core applications. For more information on how to configure HTTP/3 support please visit https://learn.microsoft.com/aspnet/core/fundamentals/servers/kestrel/http3?view=aspnetcore-8.0#getting-started and https://learn.microsoft.com/aspnet/core/fundamentals/servers/kestrel/endpoints?view=aspnetcore-8.0#configure-http-protocols-in-appsettingsjson. ## <a name="affected-software"></a>Affected software * Any ASP.NET 8.0 application running on .NET 8.0.8 or earlier. * Any ASP.NET 9.0 application running on .NET 9.0.0.RC.1 or earlier. ## <a name=


Mitigations:

Architectural layers (MAESTRO):