Microsoft Patch Tuesday 12/14/2021 Notes

Microsoft Patch Tuesday 12/14/2021 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights: Microsoft's Patch Tuesday update for December 2021 contained 72 vulnerabilities in total, with: 5 vulnerabilities rated as Critical 53 vulnerabilities rated as High 14 vulnerabilities rated as Medium

Most notable vulnerabilities

Microsoft has listed six zero-day vulnerabilities, CVE-2021-43890, CVE-2021-41333, CVE-2021-43880, CVE-2021-43893, CVE-2021-43240, and CVE-2021-43883, which are fixed in the December Patch Tuesday security update. Among the vulnerabilities, CVE-2021-43890 is known to be actively exploited in the wild.

CVE-2021-43890

CVE-2021-43890 is a spoofing vulnerability in the Windows AppX Installer, which is used to install AppX apps on Windows 10 systems. This vulnerability could allow any remote authenticated user to conduct a spoofing attack; this is due to a flaw in the AppX Installer. An attacker could exploit this vulnerability by persuading a victim to install specially crafted packages, which grants the attacker with elevated privileges over the system. This vulnerability has been linked to attacks associated with the Emotet/TrickBot/BazaLoader family.

The following product is impacted:

• Windows AppX installer on Windows 10

CVE-2021-41333

CVE-2021-41333 is a Privilege Escalation vulnerability in the Windows print spooler service for Microsoft Windows that could allow any locally authenticated attacker to gain elevated privileges on the system; this is caused by a flaw in the Print Spooler. By executing a specially crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

The following products are impacted:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 7 for 32-bit Systems Service Pack 1
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows Server, version 20H2 (Server Core Installation)
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server, version 2004 (Server Core installation)
• Windows 10 Version 2004 for x64-based Systems
• Windows 10 Version 2004 for ARM64-based Systems
• Windows 10 Version 2004 for 32-bit Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2021-43880

CVE-2021-43880 is a Privilege Escalation vulnerability in Microsoft Windows that is used only to delete targeted files on a system but not to view or modify file contents. This vulnerability exists because of the application not properly imposing security restrictions in Windows Mobile Device Management, which leads to privilege escalation and bypassing of security restrictions.

The following products are impacted:

• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems

CVE-2021-43893

CVE-2021-36948 is a Privilege Escalation vulnerability in Microsoft Windows that allows any remote authenticated attacker to escalate privileges on the system. This vulnerability is caused by improper security restrictions imposed in Windows Encrypting File System (EFS). An attacker could exploit this vulnerability to execute arbitrary code with higher privileges by executing a specially-crafted program.

The following products are impacted:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 7 for 32-bit Systems Service Pack 1
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows Server, version 20H2 (Server Core Installation)
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server, version 2004 (Server Core installation)
• Windows 10 Version 2004 for x64-based Systems
• Windows 10 Version 2004 for ARM64-based Systems
• Windows 10 Version 2004 for 32-bit Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2021-43240

It is a Privilege Escalation vulnerability in the Microsoft Windows standard file system, which would allow a local authenticated attacker to gain elevated privileges on the system. It is caused by a flaw in the New Technology File System (NTFS) set short name function. By executing a specially crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges. This vulnerability has proof-of-concept exploit code available and is known publicly.

The following products are impacted:

• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows Server, version 20H2 (Server Core Installation)
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server, version 2004 (Server Core installation)
• Windows 10 Version 2004 for x64-based Systems
• Windows 10 Version 2004 for ARM64-based Systems
• Windows 10 Version 2004 for 32-bit Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2021-43883

A vulnerability exists in the Installer component of Microsoft Windows that would allow a local authenticated attacker to gain elevated privileges on the system. An attacker could exploit this vulnerability to gain elevated privileges on the system.

The following products are impacted:

• Windows Server 2012 R2 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 (Server Core installation)
• Windows Server 2012
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows RT 8.1
• Windows 8.1 for x64-based systems
• Windows 8.1 for 32-bit systems
• Windows 7 for x64-based Systems Service Pack 1
• Windows 7 for 32-bit Systems Service Pack 1
• Windows Server 2016 (Server Core installation)
• Windows Server 2016
• Windows 10 Version 1607 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 for 32-bit Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 11 for ARM64-based Systems
• Windows 11 for x64-based Systems
• Windows Server, version 20H2 (Server Core Installation)
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for x64-based Systems
• Windows Server, version 2004 (Server Core installation)
• Windows 10 Version 2004 for x64-based Systems
• Windows 10 Version 2004 for ARM64-based Systems
• Windows 10 Version 2004 for 32-bit Systems
• Windows Server 2022 (Server Core installation)
• Windows Server 2022
• Windows 10 Version 21H1 for 32-bit Systems
• Windows 10 Version 21H1 for ARM64-based Systems
• Windows 10 Version 21H1 for x64-based Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1909 for 32-bit Systems
• Windows Server 2019 (Server Core installation)
• Windows Server 2019
• Windows 10 Version 1809 for ARM64-based Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for 32-bit Systems

CVE-2021-4102

A use-after-free vulnerability exists in V8 in Google Chrome, which could allow any remote attacker to execute arbitrary code on the system. By persuading a victim to visit a specially crafted website, a remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition on the system. This vulnerability is being exploited in the wild and affects Microsoft Edge (Chromium-based). No known exploit code is available.

The following products are impacted:

• Microsoft Edge (Chromium-based) versions prior to 96.0.1054.57

Users are advised to apply the latest security patches specified in Microsoft's November Patch Tuesday Update and follow the mitigations and workarounds to best protect themselves from the risks of these and other vulnerabilities.