Week in review: New Black Basta's social engineering campaign, passing the CISSP exam in 6 weeks

CVE-2024-23296 is a memory corruption issue (CWE-787, out-of-bounds write) in the kernels of Apple's operating systems, addressed by Apple with improved validation in its March 2024 updates. Per Apple and the CVSS vector (AV:L/PR:L/UI:N), exploitation is local with low privileges and no user interaction: an attacker who has already gained arbitrary kernel read and write capability can use the flaw to bypass kernel memory protections, meaning it is typically used in an exploit chain after an initial kernel compromise. Successful abuse defeats hardened kernel memory restrictions, potentially giving the attacker broader control over the operating system and undermining kernel-level protections. Anyone running affected versions is exposed: iPhone/iPad on iOS/iPadOS prior to the 17.4 and 16.7.8 fixes, Macs prior to macOS Sonoma 14.4, Ventura 13.6.7 or Monterey 12.7.6, Apple TV prior to tvOS 17.4, Apple Watch prior to watchOS 10.4, and Vision Pro prior to visionOS 1.1. Apple has stated the issue may have been exploited in the wild, and CISA added it to the KEV catalog on 2024-03-06; no public proof-of-concept is known and ransomware use is unknown (EPSS 1.4%, 71st percentile).

Do: Patch immediately to iOS/iPadOS 17.4 (or 16.7.8 for devices staying on iOS 16), macOS Sonoma 14.4 / Ventura 13.6.7 / Monterey 12.7.6, tvOS 17.4, watchOS 10.4 and visionOS 1.1; no workaround is documented, and CISA's KEV required action mandates applying vendor fixes (or discontinuing use) for federal agencies. Because the flaw is used to bypass kernel memory protections after an attacker already has kernel read/write, also ensure devices are current on all other Apple kernel security updates and inventory for any Apple phones, tablets, Macs or TVs running older OS versions.

A privacy issue was addressed with improved client ID handling for alternative app marketplaces. This issue is fixed in iOS 17.5 and iPadOS 17.5. A maliciously crafted webpage may be able to distribute a script that tracks users on other webpages.

CVE-2024-30040 is a high-severity (CVSS 8.8) security feature bypass in the Windows MSHTML platform, the HTML-rendering engine component embedded in Internet Explorer and many Windows applications. A remote attacker can trigger it by persuading a user to open or render specially crafted content, since the attack requires user interaction but no privileges or special conditions (AV:N/AC:L/PR:N/UI:R). Successful exploitation defeats an intended Windows security feature, and the high confidentiality, integrity, and availability impact ratings indicate it can enable significant compromise when chained with other techniques. All supported Windows 10 and Windows 11 client releases (1507 through 22H2, and 21H2 through 23H2, respectively) plus Windows Server 2016, 2019, 2022, and 2022 23H2 are affected. The flaw is being actively exploited in the wild — it was added to CISA's KEV catalog on 2024-05-14 and was one of two zero-days fixed in Microsoft's May 2024 Patch Tuesday — though no public proof-of-concept is known and EPSS estimates a 3.9% chance of exploitation in the next 30 days (90th percentile).

Do: Apply the May 2024 Patch Tuesday cumulative updates (released 2024-05-14) for Windows 10, Windows 11, and Windows Server as soon as possible; the flaw is under active exploitation and listed in CISA KEV, so prioritize endpoints and servers that render untrusted documents or HTML content. Confirm via patch reporting that the May 2024 cumulative update is installed on all assets, and in the interim caution users against opening unsolicited files and links, since exploitation requires user interaction.

CVE-2024-30051 is a heap-based buffer overflow / out-of-bounds write (CWE-122, CWE-787) in the Windows Desktop Window Manager (DWM) Core Library that allows a local attacker to escalate privileges. It is triggered by locally executing crafted code that corrupts memory in the DWM component, requiring only low privileges and no user interaction (AV:L/AC:L/PR:L/UI:N). A successful exploit yields high-impact gains on the local system — typically elevation to elevated/SYSTEM rights, giving the attacker full control of confidentiality, integrity and availability on that host. Any organization running the affected Windows 10/11 client releases or Windows Server 2016/2019/2022 with the DWM component is exposed, which in practice means nearly every modern Windows endpoint. The flaw was a zero-day exploited in the wild before remediation: it was added to CISA KEV on 2024-05-14 with known ransomware use, and public reporting ties it to QakBot attack chains and Microsoft's May 2024 Patch Tuesday (which also fixed it alongside other exploited zero-days).

Do: Apply Microsoft's May 2024 Patch Tuesday cumulative updates for every affected Windows 10/11 and Windows Server 2016/2019/2022 release immediately; per CISA KEV, apply vendor mitigations or discontinue use of affected systems if updates are unavailable. Prioritize endpoints and servers exposed to user-driven malware (email, web browsing) since the flaw is chained after initial access in QakBot and ransomware operations, and verify patched DWM/dwmcore binaries via the updated OS build. Monitor for local privilege-escalation activity and treat this as a high-priority patch alongside the other May 2024 exploited zero-days.

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

CVE-2024-4947 is a type-confusion flaw (CWE-843) in the V8 JavaScript engine of Google Chrome, rated High by Chromium with a CVSS 3.1 score of 9.6. An attacker triggers it by luring a user to a crafted HTML page, causing V8 to misinterpret object types and enabling execution of arbitrary code inside the Chrome sandbox. Exploitation of the V8 bug alone keeps the attacker sandboxed, but it is a typical first stage of a browser exploit chain and can be paired with sandbox-escape techniques for broader system access. All Google Chrome installations prior to 125.0.6422.60 are affected, as are Fedora's packaged builds of Chrome/Chromium carrying the vulnerable V8 code. The vulnerability was added to CISA's KEV on 2024-05-20, has a public PoC referenced in Google's issue tracker, and public reporting ties its in-the-wild use to the North Korean Lazarus Group, which deployed the FudModule rootkit against infected Chrome users.

Do: Upgrade Google Chrome to 125.0.6422.60 or later on all endpoints, and install the updated chromium packages published for Fedora, prioritizing this patch because the flaw is CISA KEV-listed with a mandatory mitigation deadline. Because Lazarus Group is exploiting this in the wild via crafted web pages, review endpoint telemetry for suspicious browser-borne activity and warn users against opening links from untrusted or decoy game/job-lure sites.