Microsoft’s November 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-41073)

CVE-2022-41049 and CVE-2022-41091 are security feature bypass vulnerabilities affecting Windows Mark of the Web (MoTW). MoTW is a security feature used to tag files downloaded from the internet and prevent them from performing certain actions. Files flagged with MoTW would be opened in Protected View in Microsoft Office — prompting users with a security warning banner asking them to confirm the document is trusted by selecting Enable content. A malicious actor could craft a file that could bypass MoTW “resulting in a limited loss of integrity and availability of security features such as Protected View.”

CVE-2022-41091 has been exploited in the wild and for which exploit code is publicly available. Though it was not credited to any researcher in particular, researchers at HP observed the Magniber ransomware group exploiting this vulnerability in the wild.

CVE-2022-41049 on the other hand has not been exploited in the wild, but is rated “Exploitation More Likely” according to Microsoft’s Exploitability Index. Both CVEs were given CVSSv3 scores of 5.4 and require user interaction — an attacker would need to entice a victim into opening the crafted file.

CVE-2022-41073 is an EoP vulnerability affecting the Windows Print Spooler service. The vulnerability carries a CVSSv3 score of 7.8 and discovery was credited to Microsoft Threat Intelligence Center. This flaw has been exploited in the wild, according to Microsoft, and could allow a low privileged user to gain SYSTEM level privileges.

The Windows Print Spooler service continues to gain interest from researchers and attackers alike since PrintNightmare (CVE-2021-34527) was disclosed in July of 2021. Since then a slew of vulnerabilities have been reported including another EoP (CVE-2022-38028) credited to the National Security Agency in last month’s Patch Tuesday release.

CVE-2022-41125 is an EoP vulnerability in the Windows Cryptography Next Generation (CNG) Key Isolation Service used for Windows cryptographic support and operations. With a CVSSv3 score of 7.8, successful exploitation would allow an attacker to gain SYSTEM privileges. While no additional details were provided in the advisory, this vulnerability has reportedly been exploited in the wild and is one of four CVEs in this month’s Patch Tuesday release to have been flagged as “exploitation detected” according to Microsoft.

CVE-2022-41118 and CVE-2022-41128 are RCE vulnerabilities affecting the JScript9 and Chakra scripting languages. CVE-2022-41128 has a CVSSv3 score of 8.8 and only impacts the JScript9 scripting language. It has been exploited in the wild and successful exploitation requires a user with an affected version of Windows to visit a malicious, attacker controlled server. CVE-2022-41118 on the other hand, has a CVSSv3 score of 7.5 and has not been observed to be exploited. In the case of CVE-2022-41118, an attacker would need to convince a user to connect to a malicious server hosting a specially crafted website as well as win a race condition. Despite these barriers for exploitation, Microsoft still rated CVE-2022-41118 as “Exploitation More Likely.”

This month Microsoft also released patches for a pair of recently disclosed vulnerabilities impacting OpenSSL, a widely used open source library for cryptographic implementation of secure socket layer and transport layer security protocols. These updates are available for the following products:

More information on these two vulnerabilities including Tenable product coverage can be found in our blog post.