.NET Framework Information Disclosure Vulnerability

Vulnerability

Overview

CVE-2022-41064 is an information disclosure vulnerability in the .NET System.Data.SqlClient and Microsoft.Data.SqlClient libraries. The root cause is a race condition that occurs when a query timeout happens during high load while an asynchronous query is executing. Under these conditions, the library may return data that belongs to a different query, potentially exposing sensitive information to the wrong caller [2][3].

Exploitation

Conditions

Exploitation requires the application to be communicating with Microsoft SQL Server and to execute asynchronous queries under high concurrency. The vulnerability is triggered when a timeout occurs on an async operation; the library may then reuse a connection or buffer that still contains data from a previous query, returning that stale or incorrect data to the current caller. No special authentication or network position is needed beyond normal database access [2][3].

Impact

An attacker who can cause or observe the effects of a timeout under load may receive data that was intended for another user or session. This could include sensitive database contents such as personally identifiable information (PII), credentials, or business data. The vulnerability is classified as information disclosure because the incorrect data is returned as the result of the query, not through a direct memory corruption or injection [2][3].

Mitigation

Microsoft has released updated packages to fix the issue. For System.Data.SqlClient, the secure version is 4.8.5 (or the November 2022 .NET Framework update). For Microsoft.Data.SqlClient, versions 1.1.4 and 2.1.2 or later are patched. Applications using vulnerable versions should update immediately. Applications not connecting to SQL Server are not affected [2][3].