Microsoft has released this month’s cumulative cybersecurity update known as Patch Tuesday. It’s one of the smallest updates in terms of the number of flaws addressed, but it has still fixed some important vulnerabilities, so make sure to apply the patch as soon as possible.
In a follow-up security advisory, Microsoft said that it fixed a total of 38 vulnerabilities this month (not including the 11 Microsoft Edge browser flaws fixed a week ago).
Among them are three zero-days, and six “critical” flaws allowing for remote code execution (RCE).
Fixing zero-days
Here’s a full breakdown of the update:
- 8 Elevation of Privilege Vulnerabilities
- 4 Security Feature Bypass Vulnerabilities
- 12 Remote Code Execution Vulnerabilities
- 8 Information Disclosure Vulnerabilities
- 5 Denial of Service Vulnerabilities
- 1 Spoofing Vulnerability
Of the three zero-days, two were being actively used in the wild, to attack vulnerable endpoints (opens in new tab). Those two are CVE-2023-29336, and CVE-2023-24932. The former is a Win32k Elevation of Privilege Vulnerability, a flaw in the Kernel driver that elevates privileges to the highest level – SYSTEM.
“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” Microsoft said in its advisory.
The latter is a Secure Boot Security Feature Bypass Vulnerability, which was being used in the wild to install the BlackLotus UEFI bootkit, it was said.
“To exploit the vulnerability, an attacker who has physical access or Administrative rights to a target device could install an affected boot policy,” Microsoft further explained.
UEFI bootkits are highly disruptive malware that gets installed on the system firmware, and as such remains on the target endpoint even if the operating system gets reinstalled, or the hard drive replaced. According to BleepingComputer, someone has been selling the BlackLotus bootkit on underground forums since October 2022, and has been actively working on adding new features. Since March, the bootkit was able to bypass Secure Boot on fully patched Windows 11 devices.
Via: BleepingComputer (opens in new tab)
