2024’s first Patch Tuesday steps lightly – Sophos News

• Information Disclosure: 12
• Remote Code Execution: 11
• Elevation of Privilege: 10
• Denial of Service: 6
• Security Feature Bypass: 6
• Spoofing: 3

Figure 1: You’re reading the labels correctly: Information-disclosure issues outnumber both EoP and RCE bugs in January. Security feature bypass issues – one of them Critical-severity — also make a strong showing

Products

• Windows: 38
• .NET: 5 (including on shared with Visual Studio; one shared with Microsoft Identity Model / NuGet and Visual Studio; and one shared with Azure, SQL Server, and Visual Studio)
• Visual Studio: 4 (including one shared with .NET; one shared with .NET and Microsoft Identity Model / NuGet; and one shared with .NET, Azure, and SQL Server)
• Azure: 2 (including one shared with .NET, SQL Server, and Visual Studio)
• Microsoft Identity Model / NuGet: 1 (shared with .NET and Visual Studio)
• Microsoft Printer Metadata Troubleshooter Tool: 1
• Office: 1
• SharePoint: 1
• SQL Server: 1 (shared with .NET, Azure, and Visual Studio)

Figure 2: Windows is heavily represented in this month’s patches, but several less-familiar tools and applications are also in the mix (full names shown in tables below)

Notable January updates

In addition to the issues discussed above, a few specific items are worth noting.

CVE-2024-0057 — .NET, .NET Framework, and Visual Studio Framework Security Feature Bypass Vulnerability
CVE-2024-20674 — Windows Kerberos Security Feature Bypass Vulnerability

Of this pair of security feature bypass issues, Microsoft deems only the Kerberos issue to be Critical-class. The CVSS scoring system begs to differ, since the guide to that scoring system requires that scorers consider feasible worst-case scenarios when evaluating bugs in software libraries. Their CVSS base scores are thus 9.1 and 9.0 respectively. In any case, admins are encouraged to prioritize these two patches.

CVE-2024-20696 – Windows Libarchive Remote Code Execution Vulnerability
CVE-2024-20697 – Windows Libarchive Remote Code Execution Vulnerability

The information available on these two identically named Important-class RCEs is scant, but there’s a big clue to their importance in the title: These two issues affect Libarchive, the engine for reading and writing in various compression and archive formats.

CVE-2024-20666 – BitLocker Security Feature Bypass Vulnerability

Another security feature bypass, this time in a security feature. This issue stands out for some fairly nuanced requirements around servicing the Safe OS; for most versions of Windows 11 this is now a fully automated process, and those relying on WSUS are automatically updated, but those working in more complex environments are strongly encouraged to check Microsoft’s published guidance for specific instructions. In any case, the attacker requires physical access to the targeted machine.

CVE-2024-21305 — Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability

The CVE with the lowest CVSS base score this month has something in common with the two highest-scoring CVEs: It’s yet another security feature bypass. This one, however, rates a mere 4.4 base score and requires the attacker to have physical access to the targeted machine and to have previously compromised admin credentials. It affects an assortment of Windows client and server versions and, for those still running that hardware, 15 versions of the Surface.

Sophos protections

As you can every month, if you don’t want to wait for your system to pull down Microsoft’s updates itself, you can download them manually from the Windows Update Catalog website. Run the winver.exe tool to determine which build of Windows 10 or 11 you’re running, then download the Cumulative Update package for your specific system’s architecture and build number.

Appendix A: Vulnerability Impact and Severity

This is a list of January patches sorted by impact, then sub-sorted by severity. Each list is further arranged by CVE.

Information Disclosure (12 CVEs)

Remote Code Execution (11 CVEs)

Elevation of Privilege (10 CVEs)

Denial of Service (6 CVEs)

Security Feature Bypass (6 CVEs)

Spoofing (3 CVEs)

Appendix B: Exploitability

This is a list of the January CVEs judged by Microsoft to be more likely to be exploited in the wild within the first 30 days post-release. Each list is further arranged by CVE. No CVEs addressed in the January patch collection are known to be under active exploit in the wild yet.

 Appendix C: Products Affected

This is a list of December’s patches sorted by product family, then sub-sorted by severity. Each list is further arranged by CVE. Patches that are shared among multiple product families are listed multiple times, once for each product family.

Windows (38 CVEs)

.NET (5 CVEs)

Visual Studio (4 CVEs)

Azure (2 CVEs)

Microsoft Identity Model (1 CVE)

Microsoft Printer Metadata Troubleshooter Tool (1 CVE)

Office (1 CVE)

SharePoint (1 CVE)

SQL Server (1 CVE)

Appendix D: Advisories and Other Products

This is a list of advisories and information on other relevant CVEs in the December Microsoft release, sorted by product.

Relevant to Edge / Chromium (4 CVEs)

Relevant to Windows (third-party product) (one CVE)