CVE-2024-1305
Published: 08 July 2024
Summary
CVE-2024-1305 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Openvpn Tap-Windows6. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability affects the tap-windows6 driver in versions 9.26 and earlier. It stems from insufficient validation of size data in incoming write operations, which permits memory buffer overflows. This is tracked as CWE-190 and carries a CVSS 3.1 score of 9.8, enabling outcomes that range from system bug checks to arbitrary code execution in kernel space.
Remote attackers can exploit the flaw over the network without authentication or user interaction. Successful exploitation grants full read, write, and control capabilities on the target system, affecting confidentiality, integrity, and availability.
Reference materials hosted by the OpenVPN community at the listed wiki and mailing-list URLs describe the issue and point to associated patches or updates for the affected driver. The EPSS score has remained flat at a peak of 0.0833 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-17065
Vulnerability details
tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory buffers, resulting in a bug check and potentially arbitrary code execution in kernel space
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.