Detections
Analytics

18.6.19.2.1 (L2) Disable IPv6 (Ensure TCPIP6 Parameter 'DisabledComponents' is set to '0xff (255)')

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Internet Protocol version 6 (IPv6) is a set of protocols that computers use to exchange information over the Internet and over home and business networks. IPv6 allows for many more IP addresses to be assigned than IPv4 did. Older networking, hosts and operating systems may not support IPv6 natively.

The recommended state for this setting is: DisabledComponents - 0xff (255).

Since the vast majority of private enterprise managed networks have no need to utilize IPv6 (because they have access to private IPv4 addressing), disabling IPv6 components removes a possible attack surface that is also harder to monitor the traffic on. As a result, we recommend configuring IPv6 to a Disabled state when it is not needed.

Configuring this recommendation to the CIS suggested state mitigates CVE-2024-38063 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-38063, a TCP/IP Remote Code Execution Vulnerability.

Solution

To establish the recommended configuration, set the following Registry value to 0xff (255) (DWORD) :

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters:DisabledComponents

Note: This change does not take effect until the computer has been restarted.

Note #2: Although Microsoft does not provide ADMX/ADML templates to configure this registry value, custom templates ( Configure-IPv6-Components-KB929852.ADMX/ADML ) are provided in the CIS Benchmark Build Kit to facilitate its configuration. Be aware though that simply turning off (not configured) the group policy setting with the template will not 'undo' the change once applied. Instead, the opposite setting must be applied to change the registry value to the opposite state.

Impact:

Connectivity to other systems using IPv6 will no longer operate, and software that depends on IPv6 will cease to function. Examples of Microsoft applications that may use IPv6 include: Remote Assistance, HomeGroup, DirectAccess, Windows Mail.

This registry change is documented in Microsoft Knowledge Base article 929852: How to disable IPv6 or its components in Windows https://support.microsoft.com/en-us/kb/929852.

Note: This registry change does not take effect until the next reboot.

See Also

https://workbench.cisecurity.org/benchmarks/24135

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2, STIG-ID|CVE-2024-38063

Plugin: Windows

Control ID: fd1643812043bb46b644d0916829ced3fa93ef75240396a44c51c4b253df83c2