CVE-2024-38081: .NET Denial of Service Vulnerability in Microsoft.IO.Redist
Summary
CVE-2024-38081: Microsoft Security Advisory CVE-2024-38081 | .NET Denial of Service Vulnerability. Affects Microsoft.IO.Redist versions >= 4.6.0-preview.18571.3, < 6.0.1. Fixed in 6.0.1. How to fix ↓
Also tracked for
- dotnet · Bitnami
- dotnet-sdk · Bitnami
The same CVE-2024-38081 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microsoft.IO.Redist is a NuGet package that provides high-performance, low-level I/O operations for .NET applications. It is commonly used in .NET Core projects. This package is vulnerable to a Denial of Service (DoS) attack in .NET 6.0 and earlier versions.
Vulnerability Detail
The vulnerability in Microsoft.IO.Redist allows an unprivileged user to manipulate the Visual Studio installation, resulting in an elevation of privilege. This can lead to unauthorized access and potential system compromise. The vulnerability affects any .NET 6.0 application running on .NET 6.0.31 or earlier versions.
How To Fix
Minimum fixed version
6.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability.
Conclusion
The vulnerability in Microsoft.IO.Redist can be mitigated by updating to the latest version of .NET 8.0, .NET 7.0, or .NET 6.0. It is important to promptly apply the recommended fixes to prevent potential unauthorized access and system compromise.
See every vulnerability recorded for Microsoft.IO.Redist →
FAQ
If you have a runtime or SDK with a version listed in the affected software or affected packages, you are exposed to the vulnerability. You can check your installed versions by running the 'dotnet --info' command.
The vulnerability allows an unprivileged user to manipulate the Visual Studio installation, which can lead to elevation of privilege and unauthorized access to sensitive information.
Microsoft has not identified any mitigating factors for this vulnerability.
If you have found a potential security issue in .NET 8.0, .NET 7.0, or .NET 6.0, you can email the details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty.
You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repositories are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnet/.
