Microsoft Patch Tuesday 05/11/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Standing Intelligence Requirements

VULN For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

Highlights
Microsoft's Patch Tuesday update for May 2022 contained 74 vulnerabilities in total, with:

6 vulnerabilities rated as Critical
45 vulnerabilities rated as High

The patched bugs include 3 zero-day vulnerabilities. One of these vulnerabilities, CVE-2022-26925, is being actively exploited in the wild. The other zero-days are two publicly exposed bugs: a denial of service vulnerability in Hyper-V and a new remote code execution vulnerability in Azure Synapse and Azure Data Factory.

Most notable vulnerabilities

Microsoft has listed 3 zero-day vulnerabilities (CVE-2022-26925, CVE-2022-22713, and CVE-2022-29972) among the bugs fixed in the May Patch Tuesday security update.

The other significant bugs patched in this batch of updates include a bug (CVE-2022-26937) affecting services using the Windows Network File System (NFS), as well as two privilege escalation (CVE-2022-29104 and CVE-2022-29132) and two information disclosure (CVE-2022-29114 and CVE-2022-29140) bugs in the Print Spooler component.

CVE-2022-26925
CVE-2022-26925 (CVSS score: 8.1) is a Windows LSA (Local Security Authority) Spoofing vulnerability. Because of this bug, Microsoft Windows could allow a remote attacker to conduct spoofing attacks. This bug is being actively exploited in the wild.

The following products are affected:

Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server, version 20H2 (Server Core Installation)

CVE-2022-22713
CVE-2022-22713 (CVSS score: 5.6) is a Denial of Service vulnerability in Windows Hyper-V. By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.

The following products are affected:

Windows 10 Version 21H2 for x64-based Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 21H1 for x64-based Systems

CVE-2022-29972
CVE-2022-29972 (CVSS score: 8.4) is a remote code execution vulnerability in Azure Synapse and Azure Data Factory. Magnitude Simba Amazon Redshift ODBC Driver could allow a local attacker to execute arbitrary code on the system, caused by an argument injection vulnerability in the browser-based authentication component.

The following product is affected:

Self-hosted Integration Runtime

CVE-2022-26937
CVE-2022-26937 (CVSS score: 9.8) is a Windows Network File System Remote Code Execution vulnerability. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The following products are affected:

Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server, version 20H2 (Server Core Installation)

Tags: vuln/exploit, VULN Exploitation, VULN Community, VULN Publication, all industries, global