CISA adds Stuxnet bug to Known Exploited Vulnerabilities Catalog

CVE-2010-2568 is an input-validation flaw (CWE-20) in how Microsoft Windows parses shortcut files, allowing malicious code to execute when the operating system merely displays the icon of a malicious shortcut (.lnk) file. Triggering requires nothing more than the Windows shell rendering the shortcut's icon — for example when browsing a folder containing the file, a vector widely abused via USB drives and network shares in incidents tied to Stuxnet and Gauss. A successful attacker gains arbitrary code execution with the privileges of the logged-on user, suitable for initial access or lateral movement. All Microsoft Windows systems as listed by CISA are affected; the provided data does not specify exact version ranges. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-09-15), carries a 91.3% EPSS probability of exploitation (100th percentile), and related headlines report Microsoft having to re-issue the fix more than once for Stuxnet-related attacks.

Do: Apply Microsoft updates per vendor instructions (CISA's required action); since headlines indicate this LNK fix was re-released multiple times, verify systems carry the latest cumulative Windows updates rather than only the original patch. Until patched, avoid browsing untrusted removable drives or network shares with a shell that renders shortcut icons, and monitor for LNK-delivered malware.

The Linux kernel's perf event subsystem fails to validate all 64 bits of the attr.config value supplied from user space, causing an out-of-bounds access to the perf_swevent_enabled array in sw_perf_event_destroy(). A local attacker triggers the flaw by creating a perf event with a crafted attr.config value, and the out-of-bounds access occurs when that event is destroyed, corrupting adjacent kernel memory. By corrupting memory this way, an attacker can escalate privileges from an unprivileged local user to kernel-level (root) privileges on the affected system. Any system running an affected Linux kernel where perf events are available is exposed; the provided data does not specify exact affected kernel version ranges, so operators should confirm against vendor advisories. The vulnerability is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-09-15, and EPSS assigns it a 47.7% probability of exploitation within 30 days (99th percentile).

Do: Apply kernel updates per vendor instructions as required by CISA, then reboot so the system runs the patched kernel. As interim mitigation, restrict unprivileged access to perf events (e.g., by raising the perf_event_paranoid sysctl) and limit untrusted local shell access. Verify the running kernel version against your distribution's advisory for this CVE before and after remediation.

CVE-2013-2596 is an integer overflow in the fb_mmap function in drivers/video/fbmem.c of the Linux kernel, a memory-mapping routine for framebuffer devices. The flaw is triggered when the kernel performs the arithmetic used to map framebuffer memory, and the overflowed calculation can yield an incorrect mapping that an attacker can leverage. An attacker who successfully exploits it gains elevated privileges on the affected system. Any system running an affected Linux kernel build is exposed, with the practical attack surface concentrated on systems where users can memory-map framebuffer devices; the specific vulnerable version range is not specified in the available data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-09-15, indicating exploitation in the wild, though no public proof-of-concept is known, ransomware use is unknown, and EPSS puts 30-day exploitation probability at 3.2% (87th percentile).

Do: Apply updated kernel packages per your distribution or vendor's instructions, as CISA's required action directs, prioritizing internet-exposed and multi-user systems. As an interim mitigation, audit which systems permit unprivileged access to framebuffer devices (/dev/fb*) and restrict that access. Because fixed version numbers are not specified in the available data, confirm exact patched kernel versions with your vendor before declaring remediation complete.

A stack-based buffer overflow (CWE-119) exists in the audio calibration database (acdb) audio driver from Code Aurora, the code incorporated into third-party products such as Qualcomm and Android. An attacker who can get crafted input to this driver can overwrite stack memory and escalate privileges to a higher-than-intended level on the device. Any device shipping the vulnerable Code Aurora ACDB audio driver — notably Qualcomm-powered Android products — is potentially affected, though the available data does not specify affected version ranges. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-09-15, while EPSS estimates a 1.5% probability of exploitation in the next 30 days and no public proof-of-concept is known.

Do: Apply updated audio drivers/firmware from your chipset or device vendor as soon as available, per CISA's required action to apply updates per vendor instructions, and check Qualcomm and Android security bulletins for fixes covering CVE-2013-2597. Because this is a local privilege escalation, prioritize Qualcomm-based Android devices where untrusted apps or users can execute code, and limit installation of untrusted applications on affected devices until patched.

CVE-2013-6282 is an improper input validation flaw (CWE-20) in the Linux kernel's get_user and put_user API functions, which on ARM v6k/v7 platforms fail to validate the target address before accessing it. When kernel code uses these functions with an application-supplied pointer, the address is not verified as user space, so a local application can supply a kernel-space address (for example via system calls or ioctls) and read and write kernel memory. An attacker who can already run code on the device can leverage this kernel memory access to escalate privileges to root/kernel level, which can enable persistence or further post-exploitation activity. Affected systems are Linux kernels running on ARM v6k/v7 processors, the architecture that dominated Android smartphones and much embedded Linux hardware in that era; the source data does not enumerate specific affected kernel version ranges. Despite the flaw's 2013 origin, CISA added it to the Known Exploited Vulnerabilities catalog on 2022-09-15, confirming exploitation in the wild, with EPSS estimating a 39.7% probability of exploitation within 30 days (99th percentile).

Do: Apply updates per vendor instructions (CISA required action): upgrade the Linux kernel on ARM v6k/v7 devices to a vendor-patched version and install OEM/Google security updates on Android devices, checking vendor advisories for the fixed kernel builds. Inventory legacy and internet-exposed ARM-based embedded systems still running old kernels, and because this is a local privilege escalation, restrict execution of untrusted applications and code on affected devices.

CVE-2022-40139 is an improper validation flaw in components of the rollback mechanism in Trend Micro Apex One and Apex One as a Service endpoint clients. It is triggered when an Apex One server administrator instructs managed clients to download and apply a rollback package that is not properly verified, allowing a malicious or spoofed package to reach endpoints. An attacker who exploits this gains remote code execution on the affected client machines. Exploitation requires the attacker to first obtain access to the Apex One server administration console, so it typically serves as a post-compromise escalation path that spreads control from the management server to all managed endpoints. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-09-15 and Trend Micro addressed an actively exploited Apex One zero-day, though no public proof-of-concept is known and use in ransomware campaigns is unknown.

Do: Apply Trend Micro's Apex One updates per the vendor advisory and CISA's required action (September 2022 fix or later), and for Apex One as a Service confirm the SaaS console has pushed the updated agents to all endpoints. Because exploitation requires administration console access, restrict and monitor that console (limit accounts, use strong authentication, review recent logins), rotate admin credentials if compromise is suspected, and hunt for clients that downloaded or executed rollback packages around the compromise window. Ransomware association is unknown, so treat any console compromise as potentially precursor activity.