Premature EOF Handling in CoreWCF NetTcpBinding

Executive Summary

This vulnerability exists in CoreWCF, a port of the Windows Communication Foundation service to .NET Core. Before versions 1.8.1 and 1.9.1, an unauthenticated remote attacker who can access certain CoreWCF endpoints (NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding) can cause premature EOF (End Of File) handling during the framing handshake process. This triggers a condition where one server thread-pool worker is pinned at full CPU usage per connection.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is a denial-of-service (DoS) condition. An attacker can cause one server thread-pool worker to be fully consumed at 100% CPU usage for each connection they establish, potentially exhausting server resources and degrading or disrupting service availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade CoreWCF to version 1.8.1 or 1.9.1 where the issue is fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes a denial-of-service condition by allowing an unauthenticated attacker to exhaust CPU resources on the server, leading to reduced system availability.

While the CVE description and resources do not explicitly mention impacts on compliance with standards such as GDPR or HIPAA, reduced availability of services could indirectly affect compliance if critical systems become unavailable or fail to meet uptime requirements mandated by such regulations.

However, there is no direct indication that this vulnerability leads to unauthorized access, data breach, or data integrity issues that are typically central to compliance concerns in GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an unauthenticated remote attacker triggering an infinite loop during the framing handshake process on CoreWCF net.tcp, net.pipe, or net.uds endpoints, causing high CPU usage. Detection would involve monitoring for unusually high CPU usage on servers running vulnerable CoreWCF versions (1.8.0 and 1.9.0) when connections are made to these endpoints.

Since the attack triggers a premature EOF handling issue during the handshake, one way to detect it is by observing connections that send only the 5-byte version+mode preamble and then close the connection abruptly, causing the server thread to be pinned at 100% CPU.

There are no specific detection commands provided in the resources, but general approaches include:

• Use system monitoring tools (e.g., top, htop on Linux; Task Manager or Performance Monitor on Windows) to identify processes with sustained high CPU usage.
• Use network monitoring or packet capture tools (e.g., tcpdump, Wireshark) to capture traffic on ports used by CoreWCF net.tcp, net.pipe, or net.uds endpoints and look for connections that send only the initial 5-byte preamble and then close.
• On Linux, a command like `sudo tcpdump -i <interface> port <CoreWCF_port>` can capture relevant traffic.
• On Windows, use `netstat -ano` to identify connections to the CoreWCF service ports and correlate with CPU usage.

Because the vulnerability is triggered by malformed or premature connection closes during handshake, custom scripts or tools that simulate such connections and observe server CPU behavior could be used for detection.

Upgrading to CoreWCF versions 1.8.1 or 1.9.1 is the recommended mitigation, as no workarounds are available.

Useful 0 Not Useful 0