Microsoft’s May 2023 Patch Tuesday Addresses 38 CVEs (CVE-2023-29336)

CVE-2023-24932 is a security feature bypass vulnerability in Secure Boot in Windows operating systems, which allows for running of untrusted software during the boot up process. It was publicly disclosed and exploited in the wild as a zero-day prior to a patch being available. The flaw was given a CVSSv3 score of 6.7. Exploitation of this vulnerability requires an attacker to have administrative rights or physical access to the vulnerable device, so Microsoft has rated this as “Exploitation Less Likely” according to Microsoft’s Exploitability Index.

According to the advisory, additional steps must be taken to mitigate this vulnerability. These steps are outlined in KB5025885 which specifies that the May 9, 2023 Windows security updates must be installed first. The KB article notes that this update and the associated mitigation steps are necessary due to the publicly disclosed bypass being used by the BlackLotus UEFI bootkit. More information can be found in a blog post by ESET who are also credited with disclosing CVE-2023-24932 to Microsoft alongside Tomer Sne-or with SentinelOne.

CVE-2023-24932 is the fourth security feature bypass vulnerability disclosed in 2023 in either Windows Boot Manager or Secure Boot. In April’s Patch Tuesday release, Microsoft addressed CVE-2023-28269 and CVE-2023-28249, and in January’s Patch Tuesday release, Microsoft addressed CVE-2023-21560.

CVE-2023-29325 is a RCE in the Windows Object Linking and Embedding (OLE) mechanism of Windows operating systems that was publicly disclosed and given a CVSSv3 score of 8.1. Windows OLE is a technology that allows the creation of documents that contain objects from several applications. The vulnerability lies in the processing of RTF documents and emails. Microsoft said that the Preview Pane feature in Microsoft Outlook and Office is a vector for exploitation. An unauthenticated, remote attacker can exploit this vulnerability by sending a specially crafted document to a vulnerable system. However, the vulnerability has been given a high complexity as successful exploitation requires the attacker to win a race condition and the target to be prepared for exploitation.

As well as the patch released in this month’s update, Microsoft has provided mitigation advice to prevent users from opening RTF documents or emails in Outlook and Office to reduce the risk of exploitation where immediate patching is not possible.

CVE-2023-24941 is a critical RCE vulnerability affecting supported versions of Windows Server that was given a CVSSv3 score of 9.8. The affected component is the Network File System (NFS) service, which is used for file sharing between Unix and Windows Server systems. Specifically the vulnerability affects NFSV4.1, but not NFSV2.0 or NFSV3.0. CVE-2023-24941 can be exploited by a remote, unauthenticated attacker sending a malicious call to a vulnerable server.

Microsoft provided mitigation guidance for organizations where immediate patching is not possible, which involves disabling NFSV4.1. However, this mitigation should not be applied if the server has not applied the May 2022 patch, as that release addressed a similar vulnerability, CVE-2022-26937, in NFSV2 and NFSV3.