Microsoft’s January 2023 Patch Tuesday Addresses 98 CVEs (CVE-2023-21674)

CVE-2023-21674 is an EoP vulnerability in Windows operating systems that received a CVSSv3 score of 8.8 and has been exploited in the wild as a zero day. The vulnerability exists in the Advanced Local Procedure Call (ALPC) functionality. ALPC is a message passing utility in Windows operating systems. When exploited, an attacker can leverage the vulnerability to break out of the sandbox in Chromium and gain kernel-level execution privileges.

CVE-2023-21730 is an EoP in Windows operating systems that received a CVSSv3 score of 7.8. The vulnerability exists in Windows Cryptographic Services, a suite of cryptographic utilities in Windows operating systems. The vulnerability can be exploited by a remote, unauthenticated attacker. The exploit requires no user interaction and has a low attack complexity. However, according to the Microsoft Exploitability Index, exploitation is less likely. Discovery is credited to Microsoft’s Offensive and Security Engineering (MORSE) team.

CVE-2023-21543, CVE-2023-21546, CVE-2023-21555, CVE-2023-21556 and CVE-2023-21679 are RCE vulnerabilities in Windows operating systems, all given a CVSSv3 score of 8.1. The vulnerabilities can be exploited by a remote, unauthenticated attacker targeting a machine acting as a Remote Access Server. However, the vulnerabilities have a high attack complexity, meaning the attacker will have to perform actions on the target prior to exploitation for it to be successful. Discovery is credited to RyeLv for CVE-2023-21543, and Yuki Chen with Cyber KunLun for the others.

CVE-2023-21763 and CVE-2023-21764 are EoP vulnerabilities in Microsoft Exchange Server that received CVSSv3 scores of 7.8 and could grant an authenticated attacker SYSTEM privileges. Microsoft has rated these as “Exploitation Less Likely,” but has offered no explanation why. Piotr Bazydlo with Trend Micro Zero Day Initiative is credited with reporting both of these vulnerabilities.

CVE-2023-21745 and CVE-2023-21762 are spoofing vulnerabilities in Microsoft Exchange Server that both received CVSSv3 score of 8.0. However, these flaws have distinct characteristics from one another. CVE-2023-21745 can be exploited by an adjacent attacker — either via the local area network, or over the internet — and was rated “Exploitation More Likely.” It was reported by Piotr Bazydlo with Trend Micro Zero Day Initiative. On the other hand, CVE-2023-21762 also requires an adjacent attacker, but is restricted to a shared physical or local network, or an “otherwise limited administrative domain.” Successful exploitation could lead to disclosure of New Technology LAN Manager (NTLM) hashes and NTLM relay attacks.

CVE-2023-21746 is an EoP vulnerability in Windows NTLM that received a CVSSv3 score of 7.8 and was rated “Exploitation Less Likely.” Successful exploitation would allow an attacker to gain SYSTEM privileges. It was disclosed by Andrea Pierini with Semperis and Antonio Cocomazzi with Sentinel One.