Microsoft patched 2 zero-days, 49 flaws

Microsoft’s December 2022 Patch Tuesday comes with fixes for 49 vulnerabilities, including two zero-day vulnerabilities and one that has been actively exploited.

Because they permit remote code execution, one of the most severe vulnerabilities, six of the 49 vulnerabilities fixed in today’s update are categorized as “Critical.”

The following is a list of the number of vulnerabilities in each category:

19 Elevation of Privilege Vulnerabilities, 2 Security Feature Bypass Vulnerabilities, 23 Remote Code Execution Vulnerabilities, 3 Information Disclosure Vulnerabilities, 3 Denial of Service Vulnerabilities, and 1 Spoofing Vulnerability

Read today’s articles on the Windows 10 KB5021233 and KB5021237 updates and the Windows 11 KB5021255 and KB5021234 updates for information about non-security Windows updates.

Two zero-day vulnerabilities are fixed in this month’s Patch Tuesday, one of which has been actively exploited and the other has been made public.

If a vulnerability is publicly disclosed or actively exploited and there is no official fix, Microsoft considers it to be a zero-day vulnerability.

Today’s updates address the zero-day vulnerability that was publicly disclosed and actively exploited:

Will Dormann discovered the Windows SmartScreen Security Feature Bypass Vulnerability, CVE-2022-44698.

“An attacker can create a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and the availability of Microsoft Office security features like Protected View, which rely on MOTW tagging.”

Threat actors took advantage of this vulnerability by creating malicious JavaScript files that ran on their own and were signed with a wrong signature.
When signed in this way, SmartCheck would fail and not show any security warnings about the Mark of the Web, allowing the malware to run and install itself automatically.

Numerous malware distribution campaigns, including those that spread the QBot trojan and Magniber Ransomware, actively took advantage of this vulnerability.

The additional flaw that has been made public is:

Luka Pribani discovered the DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVE-2022-44710).

“For this vulnerability to be exploited successfully, an attacker must win a race condition. SYSTEM privileges could be gained by an attacker who successfully exploits this vulnerability.

Below is the complete list of resolved vulnerabilities and released advisories in the December 2022 Patch Tuesday updates