Threat Signal Report

Microsoft Patch Tuesday 0-day Escalation of Privilege Vulnerability (CVE-2022-24521)

description-logo Description

Microsoft has released over 117 security fixes for this month's April 2022 release. Besides the usual security fixes, there were two zero days of note and they are:

CVE-2022-26904: This known zero-day flaw impacts the Windows User Profile Service. This is an EoP (elevation of privilege) vulnerability. However, exploitation has not been seen in the wild and requires a race condition to successfully exploit. This has a CVSS score of 7.0.

CVE-2022-24521: This bug is another EoP issue found in the Windows Common Log File System (CLFS) Driver. This bug has been reported by Microsoft as being actively exploited in the wild. This vulnerability was reported by the NSA and Crowdstrike to Microsoft after being observed to have been used in active attacks. This has a CVSS score of 7.8.

On a side note, another CLFS vulnerability (CVE-2022-24481) was disclosed but it was not reported to be a zero day.

Why is this Significant?

This is significant as CVE-2022-24521 was exploited as a 0-day in the wild. Exploiting CVE-2022-24521 provides elevated privileges to an attacker, and as such the security bug was likely leveraged in conjunction with an unspecified code execution vulnerability.

How Widespread is the Attack that Leverages CVE-2022-24521?

At this time, there is no information available as to how widespread the attack is. However, since the vulnerability was publicly disclosed, attacks that leverage CVE-2022-24521 may increase.

Is there Any Other Vulnerability in the April Patch Tuesday that Requires Attention?

Microsoft also released a patch for another escalation of privilege vulnerability (CVE-2022-24481). While the vulnerability was not reported nor observed to have been exploited in the wild, the Microsoft advisory states that exploitation is likely to occur. As such a patch for CVE-2022-24481 should also be applied as soon as possible. It is important to note that this CVE was not a zero day.

Has Microsoft Released Security Advisories for CVE-2022-24521 and CVE-2022-24481?

Yes, Microsoft has issued advisories for both vulnerabilities. See the Appendix for a link to "CVE-2022-24521: Windows Common Log File System Driver Elevation of Privilege Vulnerability" and "CVE-2022-24481: Windows Common Log File System Driver Elevation of Privilege Vulnerability".

Has Microsoft Released a Patch for CVE-2022-24521 and CVE-2022-24481?

Yes, Microsoft has released a patch for both vulnerabilities on April 12nd, 2022 as part of regular MS Tuesday for the month.

What is the Status of Coverage?

FortiGuard Labs has released the following IPS signature for CVE-2022-24521 in version 20.295:

MS.Windows.CVE-2022-24521.Privilege.Elevation (default action is set to pass)

FortiGuard Labs has released the following IPS signature for CVE-2022-24481 in version 20.295:

MS.Windows.CVE-2022-24481.Privilege.Elevation (default action is set to pass)


Traffic Light Protocol

Color When Should it Be used? How may it be shared?


Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.


Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.


Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.


Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.