Microsoft’s September 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-37969)

CVE-2022-37969 is an EoP vulnerability in the Windows Common Log File System (CLFS) Driver. According to Microsoft, this vulnerability has been exploited in the wild. They also note that it has been publicly disclosed prior to a patch being available.

This is a post-exploitation vulnerability, meaning it can be exploited after an attacker has gained access to a vulnerable target system via other means, including exploiting a separate vulnerability or through social engineering. They could do so using a malicious executable containing exploit code.

CVE-2022-24521, a similar vulnerability in CLFS, was patched earlier this year as part of Microsoft’s April Patch Tuesday release. CVE-2022-24521 flaw was disclosed to Microsoft by the National Security Agency (NSA) and CrowdStrike, which was also exploited in the wild. CVE-2022-37969 has been credited to several groups, including CrowdStrike, though it is unclear at this time if CVE-2022-37969 is potentially a patch-bypass for CVE-2022-24521.

CVE-2022-34718 is a RCE in Windows TCP/IP that received a CVSSv3 score of 9.8 and was rated Exploitation More Likely according to Microsoft’s Exploitability Index. This vulnerability can only be exploited against systems with Internet Protocol Security (IPsec) enabled. Successful exploitation could grant an unauthenticated attacker remote code execution. Microsoft has released patches for all supported versions of Windows, including Server Core editions.

CVE-2022-34721 and CVE-2022-34722 are RCE vulnerabilities in the Windows IKE protocol extensions that received a CVSSv3 score of 9.8 and were rated Exploitation Less Likely. The IKE protocol is a component of IPsec used to set up security associations (relationships among devices based on shared security attributes). These vulnerabilities would allow an unauthenticated, remote attacker to send a specially crafted IP packet to a target with IPsec enabled and achieve remote code execution. IPsec is used to protect sensitive data and is commonly used in virtual private networks. Yuki Chen with Cyber KunLun is credited with disclosing both of these flaws along with CVE-2022-34720, a denial of service flaw in the IKE Protocol Exchange, and CVE-2022-35830, a RCE vulnerability in the Remote Procedure Call runtime.

CVE-2022-37956, CVE-2022-37957 and CVE-2022-37964 are EoP vulnerabilities impacting the Windows Kernel. All three vulnerabilities received CVSSv3 scores of 7.8 and if exploited, could allow an attacker to gain SYSTEM level privileges. Of the three, only CVE-2022-37957 was rated as “Exploitation More Likely.” Curiously, all three impact various versions of Windows. For instance CVE-2022-37964 only affects Windows 7, Windows Server 2008 and 2008 R2. CVE-2022-37956 affects all supported versions of Windows and Windows server, while CVE-2022-37957 only affects Windows 10 and above, including Windows Server versions 2016, 2019 and 2022.