Microsoft Patch Tuesday July 2024

Microsoft addresses 138 CVEs in its July 2024 Patch Tuesday release, with five critical vulnerabilities and three zero-day vulnerabilities, two of which were exploited in the wild.

Windows Hyper-V Elevation of Privilege Vulnerability

The vulnerability tracked as CVE-2024-38080 with a CVSSv3 score of 7.8 is an EoP vulnerability in Microsoft Windows Hyper-V virtualization product. A local, authenticated attacker could exploit this vulnerability to elevate to SYSTEM privileges.

This vulnerability was exploited in the wild as a zero-day. No further details have been shared about the in-the-wild exploitation. There have been 44 vulnerabilities in Windows Hyper-V that have been patched since 2022. This is the first Hyper-V vulnerability that has been exploited in the wild as a zero-day.

Windows MSHTML Platform Spoofing Vulnerability

The vulnerability tracked as CVE-2024-38112 with a CVSSv3 score of 7.5 is a spoofing vulnerability in Windows MSHTML. An unauthenticated, remote attacker could exploit this vulnerability by convincing a potential target to open a malicious file. Microsoft notes that to successfully exploit this flaw, an attacker would also need to take “additional actions” to “prepare the target environment.”

This vulnerability was exploited in the wild as a zero-day. No further details about in-the-wild exploitation were available.

.NET and Visual Studio Remote Code Execution Vulnerability

The vulnerability tracked as CVE-2024-35264 with a CVSSv3 score of 8.1, is a RCE vulnerability affecting.NET and Visual Studio. It is the third Microsoft zero-day vulnerability patched this month. While it was not exploited in the wild, details were made public prior to the release of a patch. According to the advisory, exploitation requires an attacker to win a race condition and the exploitability reflects this as it is rated as “Exploitation Less Likely.”

Windows Imaging Component Remote Code Execution Vulnerability

The vulnerability tracked as CVE-2024-38060 with a CVSSv3 score of 8.8 is a RCE vulnerability affecting the Windows Imaging Component, a framework used for processing images. Microsoft rates this vulnerability as “Exploitation More Likely”. Exploitation of this flaw requires an attacker to be authenticated and utilize this access to upload a malicious Tag Image File Format (TIFF) file, an image type used for graphics.

Windows Win32k Elevation of Privilege Vulnerability

The vulnerability tracked as CVE-2024-38059 and CVE-2024-38066 with both assigned CVSSv3 scores of 7.8, are EoP vulnerabilities affecting Windows Win32k, a core kernel-side driver used in Windows. An attacker could exploit these vulnerabilities as part of post-compromise activity to elevate privileges to SYSTEM. Microsoft rates these vulnerabilities as “Exploitation More Likely.”

Microsoft Office Remote Code Execution Vulnerability

The vulnerability tracked as CVE-2024-38021with a CVSSv3 score of 8.8 is a RCE vulnerability affecting Microsoft Office 2016. This vulnerability rated as “Exploitation More Likely.” Successful exploitation would allow an attacker to gain elevated privileges, including write, read, and delete functionality. Microsoft notes that exploitation requires an attacker to create a malicious link that can bypass Protected View Protocol. Based on Microsoft’s description, an attacker would have to entice a user into clicking the link, by sending it to an unsuspecting user in a phishing attack. This would result in the attacker gaining access to local NTLM credential information which could be utilized for elevated access to achieve RCE.

Microsoft OLE DB Driver and SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

This month’s release included 38 CVEs for RCEs affecting SQL Server Native Client OLE DB Provider and the OLE DB Driver for SQL Server. All these CVEs received CVSSv3 scores of 8.8 and were rated as “Exploitation Less Likely.” Successful exploitation of these vulnerabilities can be achieved by convincing an authenticated user into connecting to a malicious SQL server database using an affected driver.

Systematic Identification and Characterization of Proprietary Prefetchers

The vulnerability tracked as CVE-2024-37985 with a CVSSv3 score of 5.9. Microsoft has fixed a previously disclosed “Fetch Bench” side-channel attack that can be used to steal “secret information.”

An attacker who successfully exploited this vulnerability could view heap memory from a privileged process running on the server. Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.

Patch Tuesday Summary