CVE-2023-38171 | MSRC Compact Detail

Severity

Important

Impact

Denial of Service

CVSS

7.5 base · 6.5 temporal

Release

2023-10-10

Signals

Microsoft QUIC Denial of Service Exploited: No Publicly disclosed: No Exploitability: Exploitation More Likely

CWE

CWE-476: NULL Pointer Dereference

Patch Diff

Loading module diff metadata...

Resolved binary override

Use this when the MSRC module name cannot be mapped automatically or the resolved binary looks wrong.

Old version New version

Description

No description was published by MSRC.

FAQ / Articles

FAQ-Where to find more info-CVE-2023-38171

Where can I find more information? Please see the GitHub Advisory relating to this vulnerability here: https://github.com/microsoft/msquic/security/advisories/GHSA-xh5m-8qqp-c5x7#event-111621

MSRC Fields

Module / Tag

Microsoft QUIC

Release number

2023-Oct

Latest revision

2024-12-10

CNA

Microsoft

Customer action

required

Denial of service

N/A

CVSS Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

References

MSRC

Official detail

CVE Record

CVE.org

Revision History

v1 · 2023-10-10

Information published.

v3 · 2024-12-10

To comprehensively address CVE-2023-38171, Microsoft released security updates on October 24, 2023 for all affected versions of .NET and Microsoft Visual Studio. Microsoft recommends that customers running any of these products install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

v2 · 2023-10-26

Revised the Security Updates table to include PowerShell 7.3 because this version of PowerShell 7 is affected by this vulnerability. See https://github.com/PowerShell/Announcements/issues/53 for more information.

CVE-2023-38171 · Microsoft QUIC Denial of Service Vulnerability