Microsoft Patch Tuesday July 2022

Microsoft patched 84 CVEs in its July 2022 Patch Tuesday release, with four rated as critical, 79 rated as important and one rated as unknown.

This month’s update includes patches for:

• AMD CPU Branch
• Azure Site Recovery
• Azure Storage Library
• Microsoft Defender for Endpoint
• Microsoft Edge (Chromium-based)
• Microsoft Graphics Component
• Microsoft Office
• Open-Source Software
• Role: DNS Server
• Role: Windows Fax Service
• Role: Windows Hyper-V
• Skype for Business and Microsoft Lync
• Windows Active Directory
• Windows Advanced Local Procedure Call
• Windows BitLocker
• Windows Boot Manager
• Windows Client/Server Runtime Subsystem
• Windows Connected Devices Platform Service
• Windows Credential Guard
• Windows Fast FAT Driver
• Windows Fax and Scan Service
• Windows Group Policy
• Windows IIS
• Windows Kernel
• Windows Media
• Windows Network File System
• Windows Performance Counters
• Windows Point-to-Point Tunnelling Protocol
• Windows Portable Device Enumerator Service
• Windows Print Spooler Components
• Windows Remote Procedure Call Runtime
• Windows Security Account Manager
• Windows Server Service
• Windows Shell
• Windows Storage
• Xbox

Azure Site Recovery Elevation of Privilege Vulnerability

CVE-2022-33675 is an EoP vulnerability in Azure Site Recovery, a suite of tools aimed at providing disaster recovery services. It exists due to a directory permission error which can allow an attacker to use DLL hijacking to elevate their privileges to the SYSTEM

Windows CSRSS Elevation of Privilege

CVE-2022-22047 is an EoP vulnerability in the Windows Client Server Run-Time Subsystem with a CVSSv3 score of 7.8 and is rated as Important. Microsoft says this vulnerability has been exploited in the wild, though no further details have been shared at the time of publication. However, this type of vulnerability is likely to have been used as part of post-compromise activity once an attacker has gained access to their targeted system and run a specially crafted application.

Windows Print Spooler Elevation of Privilege Vulnerabilities

CVE-2022-22022, CVE-2022-22041, CVE-2022-30206, and CVE-2022-30226 are all EoP vulnerabilities in Windows Print Spooler Components. After the deluge of vulnerability disclosures kicked off by PrintNightmare in August 2021, June 2022 was the first month in which Microsoft did not release any patches for Print Spooler. On balance, Microsoft has patched four high severity vulnerabilities in the service, all of which were rated “Exploitation Less Likely” based on Microsoft’s Exploitability Index.

If patching is not feasible at this time, all four vulnerabilities can be mitigated by disabling the Print Spooler service.

Remote Procedure Call Runtime Remote Code Execution Vulnerability

CVE-2022-22038 is an RCE vulnerability in the Remote Procedure Call Runtime impacting all supported versions of Windows. The vulnerability received a CVSSv3 score of 8.1 and, while no privileges are required, the CVSS score indicates the attack complexity is high. Microsoft further supports this with a note in the advisory stating that additional actions by an attacker are required to prepare a target for successful exploitation.

Windows Network File System Vulnerabilities

CVE-2022-22028 is an information disclosure vulnerability, while CVE-2022-22029 and CVE-2022-22039are RCE vulnerabilities in the Windows Network File System (NFS) and Exploitation Less Likely because these flaws have high attack complexity. In the case of CVE-2022-22029, an attacker would need to invest time in repeated exploitation attempts by sending constant or intermittent data. Both CVE-2022-22028 and CVE-2022-22039 require an attacker to win a race condition to exploit these vulnerabilities.

Chromium Edge

Earlier in July, Microsoft released Microsoft Edge (Chromium-based) vulnerabilities CVE-2022-2294 and CVE-2022-2295. The vulnerability assigned to each of these CVEs is in the Chromium Open Source Software (OSS) which is consumed by Microsoft Edge. It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.