US Cyber Command: Patch Windows 'Bad Neighbor' TCP/IP bug now

Update: Microsoft lowered the vulnerability's exploitability index rating and severity, more info here.

US Cyber Command warns Microsoft customers to immediately patch their systems against the critical and remotely exploitable CVE-2020-16898 vulnerability addressed during this month's Patch Tuesday.

"Update your Microsoft software now so your system isn't exploited: CVE-2020-16898 in particular should be patched or mitigated immediately, as vulnerable systems could be compromised remotely," US Cyber Command said in a tweet earlier today,

Microsoft states that the CVE-2020-16898 bug, also known as 'Bad Neighbor', is a remote code execution (RCE) vulnerability in the Windows TCP/IP stack that can also be used to trigger a denial of service (DoS) leading to a Blue Screen of Death (BSoD).

This bug can be exploited remotely by unauthenticated attackers who send maliciously crafted ICMPv6 Router Advertisement packets to a target Windows computer.

Bad Neighbor impacts both client (Windows 10 versions 1709 up to 2004) and server (Windows Server version 1903 up to 2004 and Windows Server 2019) platforms, making it a critical vulnerability for all modern Windows environments.

Microsoft's October 2020 Patch Tuesday fixed 87 vulnerabilities in total, 12 of them classified as Critical, 74 as Important, and one as moderate severity.

Denial of service proof-of-concept exploits

Microsoft has already shared a proof-of-concept (POC) with MAPP members according to a blog post published by McAfee Labs yesterday,

"The proof-of-concept shared with MAPP (Microsoft Active Protection Program) members is both extremely simple and perfectly reliable," McAfee Labs said.

"It results in an immediate BSOD (Blue Screen of Death), but more so, indicates the likelihood of exploitation for those who can manage to bypass Windows 10 and Windows Server 2019 mitigations."

Based on the details provided by Microsoft, British security firm Sophos has also been able to create a denial of service POC which causes a BSOD on any vulnerable Windows 10 or Windows Server devices.

It would not be surprising if threat actors will also soon create their own DoS exploits.

While developing a denial-of-service POC that would allow attackers to cause BSODs remotely is reasonably easy, creating an RCE exploit is extremely hard.

As SophosLabs Offensive Security researchers explained, the attackers' POC exploit would need to reliably bypass stack canaries and kernel Address Space Layout Randomization (ASLR) to successfully achieve remote code execution.

"Even so, the threat of denial of service at will with a relatively easily-crafted packet should be enough by itself to prompt rapid patching—which is the only real fix for this vulnerability," Sophos added.

CVE-2020-16898 mitigation

Microsoft provides a workaround for all customers who can't immediately apply the security update that addresses this critical security bug.

Microsoft advises customers who can't install the update to disable the ICMPv6 Recursive DNS Server (RDNSS) option using the following PowerShell command on systems running Windows 1709 and above (no reboot is needed):

netsh int ipv6 set int *INTERFACENUMBER* rabaseddnsconfig=disable

To re-enable ICMPv6 RDNSS once you applied the security update you have to use this PowerShell command (no reboot needed):

netsh int ipv6 set int *INTERFACENUMBER* rabaseddnsconfig=enable

However, it should be noted that this is only a short term fix that blocks known attack vectors, and that you can fully mitigate the vulnerability and protect vulnerable systems only by applying the security update.

---

Update October 16, 10:04 EDT: Microsoft updated the CVE-2020-16898 advisory:

• Lowered the CVSS score from 9.8 to 8.8 because the vulnerability is not routable over the internet.

• Corrected the exploitability rating from Exploitation More Likely to Exploitation Less Likely given that Buffer Security Check exploit mitigation (on by default) "makes it extremely difficult to exploit this issue for code execution."