A Bug That Doesn't Want To Die (CVE-2021-34484, CVE-2022-21919)

Twice Bypassed and Twice Micropatched, Will Third Time be a Charm?

 

 

by Mitja Kolsek, the 0patch Team

In November we issued a micropatch for a local privilege escalation in User Profile Service .This vulnerability was found and reported to Microsoft by security researcher Abdelhamid Naceri and assigned CVE-2021-34484 when initially fixed. Abdelhamid subsequently noticed that Microsoft's patch was incomplete and wrote a POC to bypass it. Based on that information, we were able to create a micropatch for what was then considered a 0day (a known vulnerability without an official vendor fix).

Microsoft then provided a fix for Abdelhamid's bypass with January 2022 Windows Updates (assigning the "new" vulnerability CVE-2022-21919), but Abdelhamid took a closer look and found another way around it (the linked article is not available at the time of this writing).

We could easily reproduce this second bypass on fully updated Windows computers, except on Windows Server 2016. While our own micropatch was not bypassable using Abdelhamid's new trick, Microsoft modified the DLL we wrote the micropatch for (profext.dll), which meant we had to port our patch to the new version of this DLL to protect users who diligently apply Windows updates.

In short, CVE-2021-34484 is again a 0day on supported Windows versions. Somewhat ironically, affected Windows computers whose official support had already ended (Windows 10 v1803, v1809,  and v2004) and have 0patch, did not have this vulnerability reopened.

We ported our micropatch to the latest profext.dll on the following Windows versions: 

1. Windows 10 v21H2 (32 & 64 bit) updated with March 2022 Updates
   
2. Windows 10 v21H1 (32 & 64 bit) updated with March 2022 Updates
   
3. Windows 10 v20H2 (32 & 64 bit) updated with March 2022 Updates
4. Windows 10 v1909 (32 & 64 bit) updated with March 2022 Updates
5. Windows Server 2019 64 bit updated with March 2022 Updates
   

 

Since this vulnerability is again a 0day, our micropatches for it became free again and will remain free until Microsoft has issued a correct official fix. To use these micropatches, create a free account in 0patch Central, then install and register 0patch Agent from 0patch.com. Everything else will happen automatically. No computer reboots will be needed. 

Users who already have 0patch installed do not have to do anything: new micropatches will get applied automatically.

We'd like to thank Abdelhamid Naceri for finding this issue and sharing details, which allowed us to create a micropatch and protect our users.

To learn more about 0patch, please visit our Help Center.

0patch Security-Adopts Windows 10 v2004 and v1909 to Keep them Running Securely

 

by Mitja Kolsek, the 0patch Team

 

As time goes on, additional Windows 10 versions go out of official support - we have previously security-adopted Windows 10 v1803 and v1809, and now we're happy to report that we're adding two versions to the list:

1. Windows 10 v2004: This version stopped receiving security updates from Microsoft in December 2021, but we've since been delivering critical security micropatches for it to keep it running securely. If you're running Windows 10 v2004 in your organization, all you need to do is install 0patch Agent on these computers and register it to an account with PRO or Enterprise subscription.
   
   
2. Windows 10 v1909: Enterprise, Education and IoT Enterprise releases of this Windows 10 version will receive its last security update from Microsoft in May this year (two months from now). At that time we will security-adopt it and start providing critical security micropatches to keep it running securely.

 

These micropatches will be included in 0patch PRO and Enterprise licenses along with all other micropatches we're issuing - which means that users protecting their Windows 10 v1909/v2004 with 0patch will also receive our occasional micropatches for "0day" vulnerabilities in various products.

In order to have our micropatches applied, users will have to have their computers fully updated with the latest official Windows Updates provided by Microsoft: December 2021 updates for v2004, and May 2022 updates for v1909.

We welcome all interested organizations to contact sales@0patch.com for information about pricing, deployment, or setting up a trial.

To learn more about 0patch, please visit our Help Center.

Micropatches for Two Similar Remote Code Execution Issues (CVE-2022-21971, CVE-2022-21974)

 

 

by Mitja Kolsek, the 0patch Team

 

Twelve days ago, security researcher Axel Souchet published detailed analyses with associated proofs-of-concept for two remotely exploitable vulnerabilities in Windows that were fixed by Microsoft with February Windows Updates. Both vulnerabilities are similar and are caused by an uninitialized pointer that a malicious RTF file can get freed while having an illegal value.

Exploitability of such issues depends on whether the attacker can get the uninitialized value to point to a chosen address and thus control the resulting memory corruption. We don't know if this is possible but following the worst-case assumption principle (and historical track record showing that to be generally possible with sufficient motivation), unexplored memory corruption issues are assumed to allow for a remote code execution.

The two vulnerabilities are:

1. CVE-2022-21971 - see Axel's POC with analysis
2. CVE-2022-21974 - see Axel's POC with analysis
   

While Axel found these vulnerabilities, he was not the only one; both issues were reported to Microsoft by Zesen Ye and Zhiniang Peng with Sangfor, and CVE-2022-21971 also by Jinquan with DBAPPSecurity Lieying Lab. There was some initial uncertainty on whether these CVE IDs really matched Axel's findings, but Zhiniang has confirmed the match.

It was trivial to reproduce both issues by simply enabling Page Heap for WordPad.exe and opening Axel's RTF documents with WordPad. While WordPad requires the user to unblock content in a security warning, opening the same document in Microsoft Word produces no warnings. We preferred using WordPad for our analysis, however, as it is present on Windows by default.

Our analysis of Microsoft's fixes for these issues revealed that, unsurprisingly, they just added pointer initialization to constructor code. The image below shows a diff between vulnerable (left) and fixed constructor (right) in RMSRoamingSecurity.dll., and something similar was done in prauthproviders.dll as well.

 

Our micropatches are logically equivalent to Microsoft's. They were written for the following Windows versions that don't receive official patches from Microsoft:

1. Windows 10 v1803 updated to May 2021
2. Windows 10 v1809 updated to May 2021
3. Windows 10 v2004 updated to December 2021
   

Note that Windows 7 and Server 2008 R2 are not affected as the vulnerable functionalities do not exist there. 

 

Here is a video showing how 0patch blocks exploitation of these vulnerabilities:

 

These micropatches have already been distributed to all online 0patch Agents with a PRO or Enterprise license. To obtain them and have them applied on your computers along with our other micropatches, create an account in 0patch Central, install 0patch Agent and register it to your account with a PRO or Enterprise subscription. Note that no computer restart is needed for installing the agent or applying/un-applying any 0patch micropatch.

To learn more about 0patch, please visit our Help Center. 

We'd like to thank Axel Souchet for publishing their analyses and providing proofs-of-concept that allowed us to reproduce these vulnerabilities and create micropatches for them. We also encourage security researchers to privately share their analyses with us for micropatching.

Micropatches for "SpoolFool" Print Spooler Elevation of Privilege (CVE-2022-21999)

by Mitja Kolsek, the 0patch Team

 

Security researcher Oliver Lyak published a detailed analysis of a local privilege escalation vulnerability in Windows Print Spooler (CVE-2020-1030), which they had previously reported to Microsoft in November 2021, and a fix for which was included three months later with February 2022 Windows Updates. (Thanks to Cliff Featherstone for pointing out we can't do math as we originally stated this was 15 months later.)

Vulnerability CVE-2022-21999, nicknamed "SpoolFool", complements numerous previously found issues in Windows Print Spooler, and like many of those, uses symbolic links to trick the Print Spooler service running with System privileges into doing something with file system that benefits the local attacker.

In this case (see proof-of-concept), the attacker makes the Print Spooler service change permissions of an attacker-chosen folder on the computer such that everyone can create files in it. It does so by creating a printer (any user can do that by default on a Windows workstation) with its own dedicated spooler folder. When Print Spooler service is restarted, it checks every printer's spooler folder to make sure it's there and properly set up - if the folder doesn't exist, the service creates it, and if the folder doesn't allow all users to write to it, it sets everyone-write permissions on it.

Oliver noticed that creating a symbolic link from a printer's spooler folder to some system folder results in Print Spooler service setting such permissions to said system folder, thus allowing the attacker to create arbitrary files there. Having this capability, the attacker can get their own executable launched by some system process.

Microsoft's patch changed the behavior of Print Spooler service such that upon restart, it no longer creates a spooler folder or change its permissions, thus redirecting printers with misconfigured spooler folders to the default spooler folder. Our micropatch does effectively the same.

The micropatch was written for the following Windows versions that don't receive official patches from Microsoft:

1. Windows 10 v1803 updated to May 2021
2. Windows 10 v1809 updated to May 2021
3. Windows 10 v2004 updated to December 2021
4. Windows 7 updated with ESU year 2, ESU year 1 or updated to January 2020
5. Windows Server 2008 R2 updated with ESU year 2, ESU year 1 or updated to January 2020
   

This micropatch has already been distributed to all online 0patch Agents with a PRO or Enterprise license. To obtain the micropatch and have it applied on your computers along with our other micropatches, create an account in 0patch Central, install 0patch Agent and register it to your account with a PRO or Enterprise subscription. Note that no computer restart is needed for installing the agent or applying/un-applying any 0patch micropatch. 

To learn more about 0patch, please visit our Help Center. 

We'd like to thank Oliver Lyak for publishing their analysis and providing a proof-of-concept that allowed us to reproduce the vulnerability and create a micropatch. We also encourage security researchers to privately share their analyses with us for micropatching.