Junglewise Threat Intelligence

CVE-2022-24512: Microsoft .NET stack buffer overflow in Double Parse routine

CVE-2022-24512 · Severity: medium · CVSS 6.3 · Published 2022-10-18

Technologies: Microsoft PowerShell. Vendors: Microsoft.

Executive brief

A vulnerability in Microsoft .NET could allow an attacker to execute malicious code on a target system. This issue affects applications built with .NET Core and .NET 5/6, as well as tools like Visual Studio and PowerShell. If exploited, an attacker could potentially take control of the affected application or the underlying computer, leading to data theft or service disruption.

Technical details

A remote code execution (RCE) vulnerability exists in .NET 6.0, .NET 5.0, and .NET Core 3.1 due to a stack-based buffer overflow within the 'Double.Parse' routine. The flaw is triggered when the library processes specially crafted input strings representing floating-point numbers. An attacker can exploit this by providing malicious input to an application that parses user-supplied numerical data, potentially leading to arbitrary code execution in the context of the application. While the attack vector is network-based, it typically requires some form of user interaction or the processing of untrusted data (UI:R). Microsoft has released patches for the .NET Runtime, SDKs, and affected versions of Visual Studio and PowerShell to address this issue.

Affected products

  • Microsoft .NET 6.0.0 to 6.0.2, 5.0.0 to 5.0.14, Core 3.1.0 to 3.1.22
  • Microsoft Visual Studio 2019 16.0 to 16.11
  • Microsoft PowerShell 7.0 to 7.2.1

Timeline

  • 2022-03-08: advisory: Initial Microsoft and GitHub advisory publication
  • 2022-03-08: patched: Fixed versions released for .NET 6.0, 5.0, and 3.1

References

Related threats