Welcome to another insightful dive into Microsoft’s Patch Tuesday! This month’s security updates address many CVEs, underscoring the ongoing battle against digital vulnerabilities. We invite you to join us to review and discuss the details of these security updates and patches.
Microsoft Patch Tuesday’s March 2024 edition addressed 64 vulnerabilities, including two critical and 58 important severity vulnerabilities. In this month’s security updates, Microsoft has not addressed any zero-day vulnerabilities known to be exploited in the wild. Microsoft has also addressed four vulnerabilities in Microsoft Edge (Chromium-based). The vulnerabilities have been patched earlier this month.
Microsoft Patch Tuesday, March edition includes updates for vulnerabilities in Microsoft Office and Components, SQL Server, Visual Studio Code, .NET, Microsoft Azure Kubernetes Service, Windows Hyper-V, Windows OLE, Windows Installer, Microsoft Graphics Component, and more.
Microsoft has fixed several flaws in multiple software, including Denial of Service (DoS), Elevation of Privilege (EoP), Information Disclosure, Remote Code Execution (RCE), Security Feature Bypass, and Spoofing.
The March 2024 Microsoft vulnerabilities are classified as follows:
| Vulnerability Category | Quantity | Severities |
| Spoofing Vulnerability | 2 | Important: 2 |
| Denial of Service Vulnerability | 6 | Critical: 1 Important: 5 |
| Elevation of Privilege Vulnerability | 24 | Important: 24 |
| Information Disclosure Vulnerability | 6 | Important: 6 |
| Remote Code Execution Vulnerability | 18 | Critical: 1 Important: 17 |
| Security Feature Bypass Vulnerability | 3 | Important: 3 |
Other Critical Severity Vulnerabilities Patched in March Patch Tuesday Edition
CVE-2024-21407: Windows Hyper-V Remote Code Execution Vulnerability
An authenticated attacker on a guest VM must send specially crafted file operation requests to hardware resources to perform remote code execution on the host server. Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment and take additional actions before exploitation to prepare the target environment.
CVE-2024-21408: Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V allows hardware virtualization. IT professionals and software developers use virtualization to test software on multiple operating systems. Hyper-V enables working professionals to perform these tasks smoothly. With the help of Hyper-V, one can create virtual hard drives, virtual switches, and numerous different virtual devices, all of which can be added to virtual machines.
Microsoft has not published any information about the vulnerability.
Other Microsoft Vulnerability Highlights
- CVE-2024-21433 is an elevation of privilege vulnerability in Windows Print Spooler. To exploit the vulnerability, an attacker is required to win a race condition. Upon successful exploitation, an attacker could gain SYSTEM privilege.
- CVE-2024-21437 is an elevation of privilege vulnerability in the Windows Graphics Component. Upon successful exploitation, an attacker could gain SYSTEM privilege.
- CVE-2024-26160 is an information disclosure vulnerability in Windows Cloud Files Mini Filter Driver. An attacker may disclose the contents of Kernel memory after successfully exploiting the vulnerability.
- CVE-2024-26170 is an elevation of privilege vulnerability in the Windows Composite Image File System (CimFS). Upon successful exploitation, an attacker could gain SYSTEM privilege.
- CVE-2024-26182 is an elevation of privilege vulnerability in the Windows Kernel. Upon successful exploitation, an attacker could gain SYSTEM privilege.
- CVE-2024-26185 is a tempering vulnerability in the Windows Compressed Folder. An attacker would have to convince users to click a link, typically through an enticement in an email or instant message, and then convince them to open the specially crafted file.
Microsoft Release Summary
This month’s release notes cover multiple Microsoft product families and products/versions affected, including, but not limited to, Windows Defender, Open Management Infrastructure, Microsoft Authenticator, Skype for Consumer, Software for Open Networking in the Cloud (SONiC), Microsoft Dynamics, Azure SDK, Microsoft Office SharePoint, Windows Kerberos, Windows USB Hub Driver, Windows USB Serial Driver, Windows Hypervisor-Protected Code Integrity, Windows Update Stack, Windows Print Spooler Components, Microsoft Windows SCSI Class System File, Windows AllJoyn API, Windows Telephony Server, Windows ODBC Driver, Microsoft WDAC OLE DB provider for SQL, Windows USB Print Driver, Windows Kernel, Windows NTFS, Microsoft Teams for Android, Microsoft WDAC ODBC Driver, Windows Cloud Files Mini Filter Driver, Microsoft Edge for Android, Windows Error Reporting, Windows Composite Image File System, Windows Compressed Folder, Microsoft QUIC, Windows Standards-Based Storage Management Service, Microsoft Exchange Server, Microsoft Office, Microsoft Intune, and Azure Data Studio.
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Qualys VMDR automatically detects new Patch Tuesday vulnerabilities using continuous updates to its Knowledgebase (KB).
You can see all your impacted hosts by these vulnerabilities using the following QQL query:
vulnerabilities.vulnerability: ( qid:`110460` OR qid:`110461` OR qid:`379492` OR qid:`379494` OR qid:`379495` OR qid:`50137` OR qid:`92121` OR qid:`92122` OR qid:`92123` OR qid:`92124` OR qid:`92126` OR qid:`92127`)
Rapid Response with Patch Management (PM)
VMDR rapidly remediates Windows hosts by deploying the most relevant and applicable per-technology version patches. You can simply select respective QIDs in the Patch Catalog and filter on the “Missing” patches to identify and deploy the applicable, available patches with one click.
The following QQL will return the missing patches for this Patch Tuesday:
( qid:`110460` OR qid:`110461` OR qid:`379492` OR qid:`379494` OR qid:`379495` OR qid:`50137` OR qid:`92121` OR qid:`92122` OR qid:`92123` OR qid:`92124` OR qid:`92126` OR qid:`92127`)
Visit the March 2024 Security Updates page to access the full description of each vulnerability and the systems it affects.
Qualys customers can scan their network with QIDs 110460, 110461, 379492, 379494, 379495, 50137, 92121, 92122, 92123, 92124, 92126, and 92127 to detect vulnerable assets.
Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.
References:
https://msrc.microsoft.com/update-guide/
https://msrc.microsoft.com/update-guide/releaseNote/2024-Mar
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21407
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21408