Actively exploited · Published Aug 8, 2023 · Assigned by microsoft
CVE-2023-38180.NET and Visual Studio Denial of Service Vulnerability
High 7.5 Exploited
In plain English
A high-severity uncontrolled resource consumption in ASP.NET Core 2.1 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on August 9, 2023). The chance it is exploited in the next 30 days is estimated at 14.1% (higher than 97% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)14.1%top 3.4% of all CVEs
Exploited in the wildYesCISA KEV since Aug 9, 2023
Attack toolingNoneno public tooling known
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 30, 2023.
Official description
.NET and Visual Studio Denial of Service Vulnerability
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aspnetcore-runtime-6.0 | 6.0.21-1.el8_8 | ALSA-2023:4645 |
| AlmaLinux:9 | aspnetcore-runtime-6.0 | 6.0.21-1.el9_2 | ALSA-2023:4644 |
| AlmaLinux:8 | aspnetcore-runtime-7.0 | 7.0.10-1.el8_8 | ALSA-2023:4643 |
| AlmaLinux:9 | aspnetcore-runtime-7.0 | 7.0.10-1.el9_2 | ALSA-2023:4642 |
| AlmaLinux:8 | aspnetcore-targeting-pack-6.0 | 6.0.21-1.el8_8 | ALSA-2023:4645 |
| AlmaLinux:9 | aspnetcore-targeting-pack-6.0 | 6.0.21-1.el9_2 | ALSA-2023:4644 |
| AlmaLinux:8 | aspnetcore-targeting-pack-7.0 | 7.0.10-1.el8_8 | ALSA-2023:4643 |
| AlmaLinux:9 | aspnetcore-targeting-pack-7.0 | 7.0.10-1.el9_2 | ALSA-2023:4642 |
| AlmaLinux:8 | dotnet | 7.0.110-1.el8_8 | ALSA-2023:4643 |
| AlmaLinux:8 | dotnet-apphost-pack-6.0 | 6.0.21-1.el8_8 | ALSA-2023:4645 |
| AlmaLinux:9 | dotnet-apphost-pack-6.0 | 6.0.21-1.el9_2 | ALSA-2023:4644 |
| AlmaLinux:8 | dotnet-apphost-pack-7.0 | 7.0.10-1.el8_8 | ALSA-2023:4643 |
| AlmaLinux:9 | dotnet-apphost-pack-7.0 | 7.0.10-1.el9_2 | ALSA-2023:4642 |
| AlmaLinux:8 | dotnet-host | 7.0.10-1.el8_8 | ALSA-2023:4643 |
| AlmaLinux:9 | dotnet-host | 7.0.10-1.el9_2 | ALSA-2023:4642 |
| AlmaLinux:8 | dotnet-hostfxr-6.0 | 6.0.21-1.el8_8 | ALSA-2023:4645 |
| AlmaLinux:9 | dotnet-hostfxr-6.0 | 6.0.21-1.el9_2 | ALSA-2023:4644 |
| AlmaLinux:8 | dotnet-hostfxr-7.0 | 7.0.10-1.el8_8 | ALSA-2023:4643 |
| AlmaLinux:9 | dotnet-hostfxr-7.0 | 7.0.10-1.el9_2 | ALSA-2023:4642 |
| AlmaLinux:8 | dotnet-runtime-6.0 | 6.0.21-1.el8_8 | ALSA-2023:4645 |
| AlmaLinux:9 | dotnet-runtime-6.0 | 6.0.21-1.el9_2 | ALSA-2023:4644 |
| AlmaLinux:8 | dotnet-runtime-7.0 | 7.0.10-1.el8_8 | ALSA-2023:4643 |
| AlmaLinux:9 | dotnet-runtime-7.0 | 7.0.10-1.el9_2 | ALSA-2023:4642 |
| AlmaLinux:8 | dotnet-sdk-6.0 | 6.0.121-1.el8_8 | ALSA-2023:4645 |
| AlmaLinux:9 | dotnet-sdk-6.0 | 6.0.121-1.el9_2 | ALSA-2023:4644 |
| AlmaLinux:8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.121-1.el8_8 | ALSA-2023:4645 |
| AlmaLinux:9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.121-1.el9_2 | ALSA-2023:4644 |
| AlmaLinux:8 | dotnet-sdk-7.0 | 7.0.110-1.el8_8 | ALSA-2023:4643 |
| AlmaLinux:9 | dotnet-sdk-7.0 | 7.0.110-1.el9_2 | ALSA-2023:4642 |
| AlmaLinux:8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.110-1.el8_8 | ALSA-2023:4643 |
| AlmaLinux:9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.110-1.el9_2 | ALSA-2023:4642 |
| AlmaLinux:8 | dotnet-targeting-pack-6.0 | 6.0.21-1.el8_8 | ALSA-2023:4645 |
| AlmaLinux:9 | dotnet-targeting-pack-6.0 | 6.0.21-1.el9_2 | ALSA-2023:4644 |
| AlmaLinux:8 | dotnet-targeting-pack-7.0 | 7.0.10-1.el8_8 | ALSA-2023:4643 |
| AlmaLinux:9 | dotnet-targeting-pack-7.0 | 7.0.10-1.el9_2 | ALSA-2023:4642 |
| AlmaLinux:8 | dotnet-templates-6.0 | 6.0.121-1.el8_8 | ALSA-2023:4645 |
| AlmaLinux:9 | dotnet-templates-6.0 | 6.0.121-1.el9_2 | ALSA-2023:4644 |
| AlmaLinux:8 | dotnet-templates-7.0 | 7.0.110-1.el8_8 | ALSA-2023:4643 |
| AlmaLinux:9 | dotnet-templates-7.0 | 7.0.110-1.el9_2 | ALSA-2023:4642 |
| AlmaLinux:8 | netstandard-targeting-pack-2.1 | 7.0.110-1.el8_8 | ALSA-2023:4643 |
| AlmaLinux:9 | netstandard-targeting-pack-2.1 | 7.0.110-1.el9_2 | ALSA-2023:4642 |
| Alpine:v3.20 | dotnet6-build | 6.0.121-r0 | ALPINE-CVE-2023-38180 |
| Alpine:v3.20 | dotnet6-runtime | 6.0.21-r0 | ALPINE-CVE-2023-38180 |
| NuGet | microsoft.aspnetcore.app.runtime.win-arm64 | 6.0.21 | GHSA-vmch-3w2x-vhgq |
| NuGet | microsoft.aspnetcore.app.runtime.win-arm64 | 7.0.10 | GHSA-vmch-3w2x-vhgq |
| NuGet | microsoft.aspnetcore.app.runtime.win-x64 | 7.0.10 | GHSA-vmch-3w2x-vhgq |
| NuGet | microsoft.aspnetcore.app.runtime.win-x64 | 6.0.21 | GHSA-vmch-3w2x-vhgq |
| NuGet | microsoft.aspnetcore.app.runtime.win-x86 | 6.0.21 | GHSA-vmch-3w2x-vhgq |
| NuGet | microsoft.aspnetcore.app.runtime.win-x86 | 7.0.10 | GHSA-vmch-3w2x-vhgq |
| NuGet | microsoft.aspnetcore.server.kestrel.transport.libuv | 2.1.40 | GHSA-vmch-3w2x-vhgq |
| NuGet | microsoft.aspnetcore.server.kestrel.transport.libuv | 6.0.21 | GHSA-vmch-3w2x-vhgq |
| NuGet | microsoft.aspnetcore.server.kestrel.transport.sockets | 2.1.40 | GHSA-vmch-3w2x-vhgq |
| Rocky Linux:8 | dotnet6.0 | 0:6.0.121-1.el8_8 | RLSA-2023:4645 |
| Rocky Linux:8 | dotnet7.0 | 0:7.0.110-1.el8_8 | RLSA-2023:4643 |
| Ubuntu:22.04:LTS | dotnet6 | 6.0.121-0ubuntu1~22.04.1 | USN-6278-2 |
| Ubuntu:22.04:LTS | dotnet6 | 6.0.121-0ubuntu1~22.04.1 | UBUNTU-CVE-2023-38180 |
| Ubuntu:22.04:LTS | dotnet7 | 7.0.110-0ubuntu1~22.04.1 | USN-6278-2 |
| Ubuntu:22.04:LTS | dotnet7 | 7.0.110-0ubuntu1~22.04.1 | UBUNTU-CVE-2023-38180 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | .NET 6.0 | 6.0.0 – before 6.0.21 |
| Microsoft | .NET 7.0 | 7.0.0 – before 7.0.10 |
| Microsoft | ASP.NET Core 2.1 | 2.0 – before 2.1.40 |
| Microsoft | Microsoft Visual Studio 2022 version 17.2 | 17.2.0 – before 17.2.18 |
| Microsoft | Microsoft Visual Studio 2022 version 17.4 | 17.4.0 – before 17.4.10 |
| Microsoft | Microsoft Visual Studio 2022 version 17.6 | 17.6.0 – before 17.6.6 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
References
- .NET and Visual Studio Denial of Service Vulnerability vendor-advisory, patch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38180 government-resource
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CL2L4WE5QRT7WEXANYXSKSU43APC5N2V/ x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWVZFKTLNMNKPZ755EMRYIA6GHFOWGKY/ x_transferred