Microsoft Releases Fixes for 90+ Vulnerabilities, Including Several Zero-Day Bugs

Microsoft has kickstarted 2023 with a comprehensive list of vulnerabilities, including several issues that have been flagged as zero-day bugs.  This Patch Tuesday list covers over 90 common and uncommon exploits, with risk scores ranging from moderate to severe.

Patch Tuesday January – Highlights

January’s Patch Tuesday highlight is CVE-2022-41099 aka the BitLocker Security Bypass Feature vulnerability. Although it has yet to be detected in the wild, the vulnerability has been proven to be viable. According to Microsoft, a threat actor can use a spiked WinRE image to circumvent the BitLocker Device Encryption feature on the system storage device. By doing so, the threat actor can gain access to any data encrypted with the BitLocker Security feature. The event can be triggered at any given time during the reset or recovery operations.

A fix for CVE-2022-41099 is available on Microsoft’s website. Despite its severity, the BitLocker Security Bypass Feature vulnerability has one major limitation – the threat actor is required to physically interact with the machine in order to trigger the event. Furthermore, per Microsoft’s advisory, the defect appears to be contained in the Windows Recovery Environment.

The second item on the list is CVE-2023-21680, a Win32K Elevation of Privilege vulnerability. An attacker can potentially gain SYSTEM-type privileges by exploiting a Win32K bug. The good news is that this vulnerability cannot be remotely exploited. An official fix for CVE-2023-21680 has been made available.

For the very last entry on our January highlights list is CVE-2023-21551, a Cryptographic Services Elevation of Privileges vulnerability. By leveraging a defect in Win’s crypto services, an attacker could easily gain SYSTEM privileges on the victim’s machine. The vulnerability’s been marked as fixed, with a patch available on Microsoft’s official website.

January’s honorable mentions list includes CVE-2023-21675 (i.e., Windows Kernel Elevation of Privileges vulnerability, CVE-2023-21527 (i.e., Windows iSCSI Service Denial of Service Vulnerability), CVE-2023-21764 (i.e., Microsoft Exchange Server Elevation of Privilege vulnerability), and CVE-2023-21758 (i.e., Windows Internet Key Exchange Extension Denial of Service vulnerability). The full list of (patched) vulnerabilities can be found below.

Wrap-Up & Additional Cybersecurity Advice

This concludes the January edition of Heimdal®’s Path Tuesday series. Stay tuned for more awesome, patch-related content. In the meantime, here are a couple of things you can try out in order to enhance the security of your endpoints.

• Automatic patching. Smaller organizations tend to rely on manual patching in order to deploy all relevant improvement-carrying packages. However, things tend to change a bit when you’re in the shoes of an IT admin catering to the needs of hundreds of users. The best way around this issue is, of course, automatic patching. If configured correctly, an automatic patching solution can ensure timely (and correct) deployment and a low risk of incompatibility. Heimdal®’s Patch & Asset Management can aid you quickly distributing your patches, regardless if they are OS-specific, 3rd party, proprietary, or UX/UI-oriented.
• Paper trail. If you’re managing a team, consider drafting up a list of patching protocols. Include dates, times, Operating Systems, tests, and everything you can think of. Don’t forget to scribble down any modifications made to the software.

Additional resources: