Microsoft Patch Tuesday – April 2024

Microsoft patched 149 CVEs in its April 2024 Patch Tuesday release, with three rated critical, 142 rated as important, and two rated as moderate. 2 of the Zeroday vulnerabilities are fixed in this release.

• 31 Elevation of Privilege Vulnerabilities
• 28 Security Feature Bypass Vulnerabilities
• 67 Remote Code Execution Vulnerabilities
• 13 Information Disclosure Vulnerabilities
• 7 Denial of Service Vulnerabilities
• 3 Spoofing Vulnerabilities

SmartScreen Prompt Security Feature Bypass Vulnerability

CVE-2024-29988 with a CVSSv3 score of 8.8, is a security feature bypass vulnerability in Microsoft Defender SmartScreen. An attacker could exploit this vulnerability by convincing a target to open a specially crafted file using social engineering tactics such as an external link or malicious attachment sent over email, instant messages, or social media.

This flaw was reported to Microsoft by some of the same researchers that disclosed CVE-2024-21412, an Internet Shortcut Files security feature bypass that was associated with a DarkGate campaign using fake installer files impersonating Apple iTunes, Notion, NVIDIA, and others.

CVE-2024-29988 is a bypass for the CVE-2024-21412 flaw and was reported by Peter Girnus of Trend Micro’s Zero Day Initiative and Google’s Threat Analysis Group Dmitrij Lenz and Vlad Stolyarov. CVE-2024-21412 was itself a bypass for another Defender SmartScreen vulnerability tracked as CVE-2023-36025, patched during the November 2023 Patch Tuesday and exploited as a zero-day to drop Phemedrone malware.

Proxy Driver Spoofing Vulnerability

CVE-2024-26234 with a CVSSv3 score of 8.8, described as a proxy driver spoofing vulnerability, was issued to track a malicious driver signed using a valid Microsoft Hardware Publisher Certificate that was found by Sophos X-Ops in December 2023 and reported by team lead Christopher Budd.

This malicious file was labeled as “Catalog Authentication Client Service” by “Catalog Thales,” likely an attempt to impersonate Thales Group. However, further investigation revealed that it was previously bundled with a marketing software called LaiXi Android Screen Mirroring.

Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability

CVE-2024-29990 with a CVSSv3 score of 9.0, is an EoP vulnerability in the Azure Kubernetes Service Confidential Containers (AKSCC). Exploitation of this flaw hinges on the preparation of a target environment by an attacker. Successful exploitation would enable an attacker to “steal credentials and affect resources beyond the security scope managed by AKSCC.” This includes taking over both “confidential guests and containers beyond the network stack it might be bound to.”

Microsoft ODBC Driver, WDAC OLE DB Driver and OLE DB Driver for SQL Server Remote Code Execution Vulnerability

There are  41 CVEs affecting multiple drivers for SQL Server, the Open Database Connectivity (ODBC) driver, WDAC OLE DB Driver and OLE DB driver. All were rated as Exploitation Less Likely according to the Microsoft Exploitability Index, with none being publicly disclosed or exploited in the wild. A full list of the CVEs is included in the table below.

Secure Boot Security Feature Bypass Vulnerability

Microsoft patched 24 CVEs in Windows Secure Boot during this month release. All are rated as Exploitation Less Likely. A full list of the CVEs is included in the table below.

Patch Tuesday Summary