Microsoft Patch Tuesday – May 2024

Microsoft addresses 59 CVEs in its May 2024 Patch Tuesday release with one critical vulnerability and three zero-day vulnerabilities, two of which were exploited in the wild.

Windows DWM Core Library Elevation of Privilege Vulnerability

CVE-2024-30051 with a CVSSv3 score of 7.8, is an EoP vulnerability in the DWM Core Library in Microsoft Windows. It was exploited in the wild as a zero-day and was publicly disclosed prior to a patch being available. A local attacker with a presence on a vulnerable system could exploit this vulnerability to gain SYSTEM privileges. This vulnerability was discovered by researchers from Google Threat Analysis Group, Google Mandiant and Kaspersky.

Microsoft also patched two other EoP vulnerabilities in the DWM Core Library (CVE-2024-30032, CVE-2024-30035) and an information disclosure vulnerability (CVE-2024-30008).

Windows MSHTML Platform Security Feature Bypass Vulnerability

CVE-2024-30040 with a CVSSv3 score of 8.8 is a security feature bypass vulnerability in the MSHTML (Trident) engine in Microsoft Windows that was exploited in the wild as a zero-day. An attacker could exploit this vulnerability by using social engineering tactics via email, social media, or instant messaging to convince a target user to open a specially crafted document. Once exploited, an attacker could execute code on the target system.

Visual Studio Denial of Service Vulnerability

CVE-2024-30046  with a CVSSv3 score of 5.9, is a denial of service (DoS) vulnerability affecting multiple versions of Microsoft Visual Studio 2022. It is rated as “Exploitation Less Likely” according to Microsoft’s Exploitability Index and its Attack Complexity rating is listed as High. This is because an attacker would need to “invest time in repeated exploitation attempts” through the sending of “constant or intermittent data” to a targeted system. DoS attacks often require a steady stream of requests to overwhelm a target system, so these ratings are expected.

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2024-30044 with a CVSSv3 score of 8.8 is a RCE vulnerability in Microsoft SharePoint Server. This vulnerability is rated as Exploitation More Likely. The exploitation of this flaw requires an attacker authenticated to a vulnerable SharePoint Server with Site Owner permissions to perform two steps:

The attacker must upload a specially crafted file to the vulnerable SharePoint Server

• The attacker then send specially crafted API requests to the SharePoint Server to “trigger deserialization of file’s parameters.” Successful exploitation would result in remote code execution “in the context of the SharePoint Server.”

Other Notable Vulnerabilities

CVE-2024-29996 and CVE-2024-30025 are elevation of privilege vulnerabilities in the Windows Common Log File System Driver. On successful exploitation, an attacker could gain SYSTEM privileges.

CVE-2024-30050 is a security feature bypass vulnerability in Windows Mark of the Web. An attacker might host a file on a server and convince a targeted user to download and open the file to exploit this vulnerability. An attacker may alter the functionality of the Mark of the Web on successful exploitation.

CVE-2024-30038 is an elevation of privilege vulnerability in Win32k. Successful exploitation of the vulnerability may allow a local, authenticated attacker to gain elevated local system or administrator privileges.

CVE-2024-30049 is an elevation of privilege vulnerability in the Windows Win32 Kernel Subsystem. On successful exploitation, an attacker could gain SYSTEM privileges.

Summary