Nelson William Gamazo Sanchez

Microsoft addressed a critical security flaw in Windows Subsystem for Linux (WSL). Details about the issue were initially withheld but are scheduled for release on August 12.

The issue is related to the improper neutralization of special elements used in a command, also known as 'command injection', in Microsoft Visual Studio. This allows an authorized attacker to execute code over a network.

The issue allows a remote DNS server to respond with a custom crafted DNS NSEC resource record, triggering an infinite loop in the `dns packet read type window()` function of the 'systemd-resolved' service. This can cause a denial of service (DoS) of the affected service.

The issue is related to a remote code execution vulnerability in the Microsoft Windows Domain Name System (DNS) DNSAPI.dll. It occurs when the system fails to properly handle DNS responses. This can be exploited by a remote attacker using specially crafted DNS responses, potentially allowing them to execute arbitrary code or cause a denial of service. The estimated number of potentially affected devices and details about real-world incidents are not provided.