Microsoft May 2023 Patch Tuesday fixes 3 zero-days, 38 flaws

CVE-2023-29336 – Win32k Elevation of Privilege Vulnerability

Microsoft has fixed a privilege elevation vulnerability in the Win32k Kernel driver that elevates privileges to SYSTEM, Windows’ highest user privilege level.

“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” reads Microsoft’s advisory.

While Microsoft reports that the bug is actively exploited, there are no details on how it was abused.

Microsoft says that Jan Vojtešek, Milánek, and Luigino Camastra with Avast discovered the vulnerability.

CVE-2023-24932 – Secure Boot Security Feature Bypass Vulnerability

Microsoft has fixed a Secure Boot bypass flaw used by a threat actor to install the BlackLotus UEFI bootkit.

“To exploit the vulnerability, an attacker who has physical access or Administrative rights to a target device could install an affected boot policy,” reads Microsoft’s advisory.

UEFI bootkits are malware planted in the system firmware and are invisible to security software running within the operating system because the malware loads in the initial stage of the booting sequence.

Since October 2022, a threat actor has been selling the BlackLotus bootkit on hacker forums and continues to evolve its features. For example, in March, ESET reported that the developed improved the malware to bypass Secure Boot even on fully patched Windows 11 operating systems.

Microsoft released guidance last month on how to detect BlackLotus UEFI bootkit attacks. With today’s Patch Tuesday, Microsoft fixed the vulnerability used by the bootkit but has not enabled it by default.

“The security update addresses the vulnerability by updating the Windows Boot Manager, but is not enabled by default,” explains Microsoft’s advisory.

“Additional steps are required at this time to mitigate the vulnerability. Please refer to the following for steps to determine impact on your environment: KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932.”

Microsoft says this vulnerability is a bypass for the previously fixed CVE-2022-21894 vulnerability.

CVE-2023-29325 – Windows OLE Remote Code Execution Vulnerability

Microsoft has fixed a Windows OLE flaw in Microsoft Outlook that can be exploited using specially crafted emails.

“In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted email to the victim,” warns Microsoft’s advisory.

“Exploitation of the vulnerability might involve either a victim opening a specially crafted email with an affected version of Microsoft Outlook software, or a victim’s Outlook application displaying a preview of a specially crafted email.”

“This could result in the attacker executing remote code on the victim’s machine.”

However, an attacker must win a ‘race’ condition and take additional actions to exploit the flaw successfully.

Microsoft says that users can mitigate this vulnerability by reading all messages in plain text format.

Will Dormann of Vuln Labs discovered the vulnerability.