Microsoft Fixes Two Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-23960 | Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information. NVD description · AI analysis pending | 5.6 | <1% |
| — | ||
| CVE-2022-34721 +1 in the same advisory: …34722 | Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 79% |
| — | ||
| CVE-2022-37969 | Out-of-bounds write flaw in Microsoft Windows CLFS driver enables privilege escalation The Windows Common Log File System (CLFS) driver contains an input-validation flaw (CWE-20) that leads to an out-of-bounds write (CWE-787), allowing an attacker who already has a foothold or local access on a system to escalate privileges. It is triggered when the driver processes malformed or specially crafted common log file data, rather than via a remote network request on its own. Successful exploitation yields elevated (typically SYSTEM-level) privileges, giving the attacker full control of the host and making the bug a common post-exploitation link in ransomware chains. CISA lists the affected product broadly as 'Microsoft Windows', so essentially all Windows installations current at the time of disclosure were in scope. The flaw is confirmed exploited in the wild: CISA added it to the KEV catalog on 2022-09-14 with known ransomware use, EPSS puts 30-day exploitation probability at 28.3% (98th percentile), and no public PoC is known. Do: Apply Microsoft's September 2022 (or later) cumulative updates to every Windows host per vendor instructions, prioritizing endpoints and servers exposed for user or remote access. Because this is a local privilege escalation, treat it as a post-exploitation risk: also harden and patch initial-access surfaces (RDP, VPN, other exposed services) and hunt for signs of compromise such as unexpected SYSTEM-spawned processes or anomalous activity involving clfs.sys. Ransomware operators are known to use this bug, so remediation should be treated as urgent. | 7.8 | 28% | KEV ransomware |
| mass>1 billion Windows devices (essentially all Windows installations at the time of disclosure; exploitation requires an existing local foothold) |
Full article359 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft released fixes for over 60 CVEs this month including two zero-day vulnerabilities, one of which is being actively exploited in the wild.
The latter is an elevation of privilege vulnerability in Windows Common Log File System Driver (CVE-2022-37969), which affects all Windows versions and could enable attackers to gain system privileges.
“The attack does require the attacker to have access and ability to run code on the target system, but chaining multiple vulnerabilities in an attack is common enough practice that this should be considered a minor barrier for threat actors,” explained Ivanti VP of security products, Chris Goettl.
“The vulnerability is rated as ‘important,’ but with multiple vendors acknowledged for the coordinated disclosure and confirmed exploits in the wild it should be treated as a ‘critical’ severity due to the risk. Exploitation has already been detected and additional information could have been disclosed making it easier for additional attackers to take advantage of the vulnerability.”
The second publicly disclosed bug is found in in ARM-based Windows 11 systems and could allow cache speculation restriction (CVE-2022-23960). Known as Spectre-BHB, it could be described as a side-channel speculation vulnerability in ARM processors.
This month’s Patch Tuesday update round has seen Microsoft pass 1000 CVEs for the year, putting the company on track to exceed the 1200 it fixed in 2021, according to Qualys.
There are a total of five critical patches for sysadmins to consider this month, including remote code execution bugs CVE-2022-34722 and CVE-2022-34721, which impact Windows Internet Key Exchange (IKE) Protocol Extensions. Both have a CVSS score of 9.8.
“They both have low complexity for exploitation and allow threat actors to perform the attack with no user interaction. An unauthenticated attacker could send a specially crafted IP packet to a target machine that is running Windows and has IPSec enabled, which could enable remote code execution,” warned Action1 co-founder, Mike Walters.
“This vulnerability impacts only IKEv1 and not IKEv2. However, all Windows Servers are affected because they accept both V1 and V2 packets. There is no exploit or proof-of-concept detected in the wild yet, but installing the fix is highly advisable.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/microsoft-fixes-two-zerodays-patch/