CVE-2023-38180 is a high-severity Denial of Service vulnerability affecting .NET and Visual Studio, with a CVSS score of 7.5. This vulnerability impacts various systems, including those running Microsoft Visual Studio 2022, .NET 6.0, .NET 7.0, and ASP.NET Core 2.1. It has been publicly disclosed but not exploited, and is listed in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability can lead to slow read attacks, causing disruptions in affected systems and services.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, check if you're using any of the following software: Microsoft .NET 6.0.0, Microsoft .NET 7.0.0, Microsoft ASP.NET Core 2.1, or Microsoft Visual Studio 2022 (versions 17.2.0 to 17.2.18, 17.4.0 to 17.4.10, and 17.6.0 to 17.6.6). If you're using any of these versions, your system may be at risk of a Denial of Service attack due to this vulnerability. It's important to stay informed about security updates and apply them as needed to protect your system.

What should I do if I'm affected?

If you're affected by the vulnerability, take the following steps to protect your system: Update your software to the latest version, specifically Microsoft Visual Studio 2022, .NET 6.0, .NET 7.0, and ASP.NET Core 2.1. Stay informed about security updates and apply them as needed. For Fedora users, use the dnf update program to install the necessary updates. Remember to verify package signing with the Fedora Project GPG keys.

Is CVE-2023-38180 in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, CVE-2023-38180 is listed in CISA's Known Exploited Vulnerabilities Catalog. This high-severity vulnerability, known as the Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability, was added to the catalog on August 9, 2023. The due date for addressing this vulnerability is August 30, 2023. To protect your system, it's crucial to apply mitigations as per vendor instructions or discontinue the use of the affected product if mitigations are unavailable.

Weakness enumeration

The Weakness Enumeration section for CVE-2023-38180 indicates insufficient information (NVD-CWE-noinfo) about the vulnerability's specific weakness. This Denial of Service vulnerability affects .NET and Visual Studio software.

For more details

CVE-2023-38180 is a high-severity Denial of Service vulnerability affecting .NET and Visual Studio. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• Fedora 38 Update: dotnet7.0-7.0.110-1.fc38

• Fedora 37 Update: dotnet7.0-7.0.110-1.fc37 (1)

• Microsoft Security Update Guide: CVE-2023-38180

• CISA Binding Operational Directive 22-01