Purpose of Work:

December's patch Tuesday has arrived, and it looks like Microsoft is taking it a bit easy for the holidays as a present to us all.  There are 52 windows vulnerabilities being patched this month, compared to 67 in December 2021. 

Of those 52 vulnerabilities, 1 is under active exploitation, and another is publicly disclosed.  Neither of these vulnerabilities are remote code execution vulnerabilities.

Preliminary reports from early adopters indicate no apparent widespread issues, and the test environment has shown no major trouble, post-update.  Most of the issues I see reports of are lingering issues from last month's patches ( visible for various versions of the OS via the sidebar here: https://learn.microsoft.com/en-us/windows/release-health/status-windows-10-1607-and-windows-server-2016 ), with the worst of them having been hotfixed (the Kerberos authentication problems from last month's hardening).

Unfortunately, while I don't see new known issues this month (so far...), that does leave 2 known issues unaddressed with this round of updates, so far: the ODBC connection problems and the LSASS memory leak.  We at least haven't see any reported problems stemming from them, but it's good to be aware of the problems.


To kick off the highlights, we'll start with the vulnerability that's currently in the wild, a security feature bypass vulnerability leveraging the "mark of the web" (MOTW) security feature, and affecting Windows 10 and Server 2016 and up, respectively ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698 ).  This, like previous similar vulnerabilities, allows an attacker to craft a malicious file in such a way that it evades the MOTW tagging all downloaded files, or files attached to email get that flag microsoft smartscreen to prompt the user to avoid executing it.  Obviously, this can be used to great effect with phishing and malicious websites, so we recommend you patch your workstations, VDIs and RDS environments ASAP.

2nd on the list, we have a publicly disclosed elevation of privilege vulnerability leveraging DirectX 11, and seemingly affecting only Windows 11 builds ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44710 ).  This attack is listed as high complexity, requiring that the attacker win at least one race condition.  Interestingly, it's capable of breaching appcontainer isolation, in addition to granting system privileges: ( https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation).

3rd up, we have a remote code execution vulnerability leveraging windows powershell, and affecting all supported versions of windows: ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41076 ).  This exploit is not public at time of writing, but while it does have a network attack vector, it has low privileges required in addition to high complexity... so it does not seem wormable, even if the scope is broad.  Still something we'll be taking care of ASAP for managed workloads.

4th, we've got an Arbitrary Code Execution vulnerability leveraging and affecting all versions of .net on all supported versions of windows (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41076 ).  There does seem to be some mixing and matching involving which specific versions of .net are affected on specific versions of windows.  Because of the nature of .net (which often underpins web apps), Microsoft is treating this as a remote code execution vulnerability.  It is unclear if this exploit would give the attacker elevation privileges as well, but unlikely.  This does appear to require 'user interaction', and no authentication, but such interaction could easily be provided by a website.  As such, webservers in particular should be patched to avoid this one.



There are a few other vulnerabilities worth mentioning offhand without further detail: a Hyper-V DOS ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44682 ) and EOP vulnerability ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41094 ), a Microsoft Outlook MAC spoofing bug ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44713 ), and two printer spooler service EOP vulnerabilities ( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41094 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44682 ).  


As usual, we're only scratching the surface with the highlights.  The rest of the updates this month are all reviewable at https://msrc.microsoft.com/update-guide with the proper filtering.


Impact of Work:


All affected hosts that are 2012 and up will be rebooted automatically / ASAP to propagate fixes, starting at 11:30PM, with some exceptions.

Overflow work may continue the following night at 9pm and onwards.

Internal systems on Windows 2012 and up (such as the management portal) may be temporarily impacted in the time it takes to reboot them.  Mail delivery to our helpdesk may be temporarily halted while our mail servers are updated as part of this patch cycle.  If you receive a delivery failure, you can still reach us by logging directly into the helpdesk and submitting a ticket directly via the portal, or calling us at 303-414-6910 x2, for emergencies.  


Hypervisors in a failover cluster will have rolling reboots done, in order to eliminate VPS downtime on said clusters.  Hypervisors not in a failover cluster will either be updated overnight, or have their updates scheduled, depending on customer policy / VM density.

Hypervisors in DR scenarios may be updated up to one hour early, as they are not running active workloads.

Any hosts where updates are managed directly by the customer (or an approval process is required for zero-day updates) will not be impacted; the controlling organizations will be notified separately.