CVE-2024-38148: high-severity vulnerability in Microsoft Windows 11 version 21H2
Windows Secure Channel Denial of Service Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in Windows Secure Channel (SChannel) allows an attacker to cause a denial of service by sending specially crafted network packets. This can crash or hang Windows services that rely on secure communications, making them unavailable to legitimate users.
Out-of-bounds read vulnerability (CWE-125) in Windows SChannel implementation triggered by malformed TLS/SSL handshake packets. An unauthenticated remote attacker can send specially crafted packets to cause memory access violations, leading to service crash or DoS. No user interaction required.
In the same product, most dangerous first.