Threat Signal Report

Microsoft Patch Tuesday 0-day Escalation of Privilege Vulnerability (CVE-2022-24521)

Description

Microsoft has released over 117 security fixes for this month's April 2022 release. Besides the usual security fixes, there were two zero days of note and they are:

CVE-2022-26904: This known zero-day flaw impacts the Windows User Profile Service. This is an EoP (elevation of privilege) vulnerability. However, exploitation has not been seen in the wild and requires a race condition to successfully exploit. This has a CVSS score of 7.0.

CVE-2022-24521: This bug is another EoP issue found in the Windows Common Log File System (CLFS) Driver. This bug has been reported by Microsoft as being actively exploited in the wild. This vulnerability was reported by the NSA and Crowdstrike to Microsoft after being observed to have been used in active attacks. This has a CVSS score of 7.8.

On a side note, another CLFS vulnerability (CVE-2022-24481) was disclosed but it was not reported to be a zero day.

Why is this Significant?

This is significant as CVE-2022-24521 was exploited as a 0-day in the wild. Exploiting CVE-2022-24521 provides elevated privileges to an attacker, and as such the security bug was likely leveraged in conjunction with an unspecified code execution vulnerability.

How Widespread is the Attack that Leverages CVE-2022-24521?

At this time, there is no information available as to how widespread the attack is. However, since the vulnerability was publicly disclosed, attacks that leverage CVE-2022-24521 may increase.

Is there Any Other Vulnerability in the April Patch Tuesday that Requires Attention?

Microsoft also released a patch for another escalation of privilege vulnerability (CVE-2022-24481). While the vulnerability was not reported nor observed to have been exploited in the wild, the Microsoft advisory states that exploitation is likely to occur. As such a patch for CVE-2022-24481 should also be applied as soon as possible. It is important to note that this CVE was not a zero day.

Has Microsoft Released Security Advisories for CVE-2022-24521 and CVE-2022-24481?

Yes, Microsoft has issued advisories for both vulnerabilities. See the Appendix for a link to "CVE-2022-24521: Windows Common Log File System Driver Elevation of Privilege Vulnerability" and "CVE-2022-24481: Windows Common Log File System Driver Elevation of Privilege Vulnerability".

Has Microsoft Released a Patch for CVE-2022-24521 and CVE-2022-24481?

Yes, Microsoft has released a patch for both vulnerabilities on April 12nd, 2022 as part of regular MS Tuesday for the month.

What is the Status of Coverage?

FortiGuard Labs has released the following IPS signature for CVE-2022-24521 in version 20.295:

MS.Windows.CVE-2022-24521.Privilege.Elevation (default action is set to pass)

FortiGuard Labs has released the following IPS signature for CVE-2022-24481 in version 20.295:

MS.Windows.CVE-2022-24481.Privilege.Elevation (default action is set to pass)