CVE-2024-21392: microsoft microsoft visual studio 2022 version 17.4 Uncontrolled Resource Consumption

CVSS: 7.5v3.1HighAnalyzed

AliasesRHSA-2024:1308RHSA-2024:1309RHSA-2024:1310+7 more

Published 12-03-2024Last modified 03-05-2025

Vulnerability summary

CVE-2024-21392 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in microsoft microsoft visual studio 2022 version 17.4. EPSS estimates a 3.09% chance of exploitation in the next 30 days, higher than 87.5% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

3.09%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

12-03-2024
PublishedVulnerability first disclosed.
03-05-2025
Last modifiedVulnerability information updated.

Description

.NET and Visual Studio Denial of Service Vulnerability

CVSS metrics

5 scores · 5 sources · 1 version

v3.17.5

EPSS trend

Probability

3.09%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.09% on 19-09-2026

19-09-202619-10-2026

EPSS score

3.09%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Redhat39 products

aspnetcore-runtime-7.0< 0:7.0.17-1.el8_9 | < 0:7.0.17-1.el9_3
aspnetcore-runtime-8.0< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9
aspnetcore-runtime-dbg-8.0< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9
aspnetcore-targeting-pack-7.0< 0:7.0.17-1.el8_9 | < 0:7.0.17-1.el9_3
aspnetcore-targeting-pack-8.0< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9

dotnet< 0:8.0.103-1.el8_9
dotnet-apphost-pack-7.0< 0:7.0.17-1.el8_9 | < 0:7.0.17-1.el9_3
dotnet-apphost-pack-7.0-debuginfo< 0:7.0.17-1.el8_9 | < 0:7.0.17-1.el9_3
dotnet-apphost-pack-8.0< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9
dotnet-apphost-pack-8.0-debuginfo< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9
dotnet-host< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9
dotnet-host-debuginfo< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9
dotnet-hostfxr-7.0< 0:7.0.17-1.el8_9 | < 0:7.0.17-1.el9_3
dotnet-hostfxr-7.0-debuginfo< 0:7.0.17-1.el8_9 | < 0:7.0.17-1.el9_3
dotnet-hostfxr-8.0< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9
dotnet-hostfxr-8.0-debuginfo< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9
dotnet-runtime-7.0< 0:7.0.17-1.el8_9 | < 0:7.0.17-1.el9_3
dotnet-runtime-7.0-debuginfo< 0:7.0.17-1.el8_9 | < 0:7.0.17-1.el9_3
dotnet-runtime-8.0< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9
dotnet-runtime-8.0-debuginfo< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9
dotnet-runtime-dbg-8.0< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9
dotnet-sdk-7.0< 0:7.0.117-1.el8_9 | < 0:7.0.117-1.el9_3
dotnet-sdk-7.0-debuginfo< 0:7.0.117-1.el8_9 | < 0:7.0.117-1.el9_3
dotnet-sdk-7.0-source-built-artifacts< 0:7.0.117-1.el8_9 | < 0:7.0.117-1.el9_3
dotnet-sdk-8.0< 0:8.0.103-2.el9_3 | < 0:8.0.103-1.el8_9
dotnet-sdk-8.0-debuginfo< 0:8.0.103-2.el9_3 | < 0:8.0.103-1.el8_9
dotnet-sdk-8.0-source-built-artifacts< 0:8.0.103-2.el9_3 | < 0:8.0.103-1.el8_9
dotnet-sdk-dbg-8.0< 0:8.0.103-2.el9_3 | < 0:8.0.103-1.el8_9
dotnet-targeting-pack-7.0< 0:7.0.17-1.el8_9 | < 0:7.0.17-1.el9_3
dotnet-targeting-pack-8.0< 0:8.0.3-2.el9_3 | < 0:8.0.3-1.el8_9
dotnet-templates-7.0< 0:7.0.117-1.el8_9 | < 0:7.0.117-1.el9_3
dotnet-templates-8.0< 0:8.0.103-2.el9_3 | < 0:8.0.103-1.el8_9
dotnet7.0< 0:7.0.117-1.el8_9 | < 0:7.0.117-1.el9_3
dotnet7.0-debuginfo< 0:7.0.117-1.el8_9 | < 0:7.0.117-1.el9_3
dotnet7.0-debugsource< 0:7.0.117-1.el8_9 | < 0:7.0.117-1.el9_3
dotnet8.0< 0:8.0.103-2.el9_3 | < 0:8.0.103-1.el8_9
dotnet8.0-debuginfo< 0:8.0.103-2.el9_3 | < 0:8.0.103-1.el8_9
dotnet8.0-debugsource< 0:8.0.103-2.el9_3 | < 0:8.0.103-1.el8_9
netstandard-targeting-pack-2.1< 0:8.0.103-2.el9_3 | < 0:8.0.103-1.el8_9

Show all 39

NuGet12 products

Microsoft.NETCore.App.Runtime.linux-arm≥ 7.0.0-preview.1.22076.8, < 7.0.17 | ≥ 8.0.0, < 8.0.3
Microsoft.NETCore.App.Runtime.linux-arm64≥ 7.0.0-preview.1.22076.8, < 7.0.17 | ≥ 8.0.0, < 8.0.3
Microsoft.NETCore.App.Runtime.linux-musl-arm≥ 7.0.0-preview.1.22076.8, < 7.0.17 | ≥ 8.0.0, < 8.0.3
Microsoft.NETCore.App.Runtime.linux-musl-arm64≥ 7.0.0-preview.1.22076.8, < 7.0.17 | ≥ 8.0.0, < 8.0.3
Microsoft.NETCore.App.Runtime.linux-musl-x64≥ 7.0.0-preview.1.22076.8, < 7.0.17 | ≥ 8.0.0, < 8.0.3

Show all 12

Microsoft11 products

microsoft visual studio 2022 version 17.4≥ 17.4.0, < 17.4.17
microsoft visual studio 2022 version 17.6≥ 17.6.0, < 17.6.13
microsoft visual studio 2022 version 17.8≥ 17.8.0, < 17.8.8
microsoft visual studio 2022 version 17.9≥ 17.0, < 17.9.3
.net≥ 7.0.0, < 7.0.17 | ≥ 8.0.0, < 8.0.3

Show all 11

Ubuntu2 products

dotnet7< 7.0.117-0ubuntu1~22.04.1
dotnet8< 8.0.103-8.0.3-0ubuntu1~22.04.1

4 vendors · 64 products

References

23 links

msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21392Vendor AdvisoryREPORTWEBPatch
access.redhat.com/errata/RHSA-2024:1308Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2268266REPORT
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1308.jsonAdvisory
access.redhat.com/security/cve/CVE-2024-21392REPORT
www.cve.org/CVERecord?id=CVE-2024-21392AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2024-21392Advisory
access.redhat.com/errata/RHSA-2024:1309Advisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1309.jsonAdvisory

Show all 23 references

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities