CVE-2021-24086: 
vulnerability analysis and mitigation

Windows TCP/IP Denial of Service Vulnerability (CVE-2021-24086) is one of three significant TCP/IP vulnerabilities discovered internally by Microsoft in February 2021. This Important-rated vulnerability affects Windows TCP/IP implementation and received a CVSSv3 score of 7.5. The vulnerability was disclosed alongside two other critical Remote Code Execution flaws (CVE-2021-24074 and CVE-2021-24094) as part of Microsoft's February 2021 Patch Tuesday release (MSRC Blog, Tenable Blog).

The vulnerability specifically affects the Windows TCP/IP implementation's handling of IPv6 fragments. Microsoft researchers indicated that while the two companion RCE vulnerabilities would be difficult to exploit, this DoS vulnerability would be easier to weaponize. The vulnerability could allow a remote attacker to trigger a denial of service condition by causing a stop error in the Windows system (MSRC Blog).

Successful exploitation of this vulnerability could allow an attacker to cause a denial of service condition by triggering a blue screen on any Windows system that is directly exposed to the internet with minimal network traffic. This could potentially affect system availability and require a restart (MSRC Blog, Tenable Blog).

Microsoft researchers assessed that creating exploits for this DoS vulnerability would be relatively quick compared to the companion RCE vulnerabilities, and expected exploits to emerge shortly after the disclosure. At the time of disclosure, there was no evidence of the vulnerability being exploited in the wild (MSRC Blog).

Microsoft provided both patch and pre-patch mitigation options. The primary recommendation is to apply the February 2021 security updates as quickly as possible. For systems where immediate patching is not feasible, Microsoft provided workarounds that involve blocking IPv6 fragments, though this may negatively impact services with IPv6 dependencies. Additionally, these mitigations can be implemented at the network edge using load balancers or firewalls (MSRC Blog).

Security researchers, including Kevin Beaumont, noted that while the vulnerability was discovered internally at Microsoft and not exploited in the wild, the DoS exploit creation would be relatively straightforward compared to the companion RCE vulnerabilities (Tenable Blog).