In PVRSRVRGXSubmitTransferKM of rgxtransfer.c, there is a possible user after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-238918403
samba-4.17.0-1.fc38
Automatic update for samba-4.17.0-1.fc38.
* Tue Sep 13 2022 Andreas Schneider <asn@redhat.com> – 4.17.0-1
– resolves: rhbz#2118818 – Update to version 4.17.0
– resolves: rhbz#2121138 – Fix CVE-2022-32743
– resolves: rhbz#2122650 – Fix CVE-2022-1615
* Tue Sep 13 2022 Andreas Schneider <asn@redhat.com> – 4.17.0-0.11.rc5
– resolves: rhbz#2093656 – Split out libnetapi(-devel) sub-packages
– resolves: rhbz#2096405 – Add samba-usershare package
libdwarf-0.4.2-1.fc37
Update to latest upstream release
Mobile security firm Quokka—which earlier this week rebranded from its previous name, Kryptowire—is launching a new smartphone protection product called Q-Scout, designed to offer deep insight into applications on Android and iOS devices without being intrusive to end users.
Q-Scout has two primary functions. First, it checks through individual applications on an end-user’s device to detect apps with known security flaws. Second, it analyzes the interaction and permission sets granted to installed apps to detect any potentially dangerous interactions. One example would be an app that has permission to access the camera and another with access to the internet—if those two apps are able to communicate freely with one another, it could create the opportunity to exfiltrate photos from the device.
Microsoft’s September 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-37969)
Microsoft addresses 62 CVEs in its September 2022 Patch Tuesday release, including five critical flaws.
5Critical
57Important
0Moderate
0Low
Microsoft patched 62 CVEs in its September 2022 Patch Tuesday release, with five rated as critical and 57 rated as important. This count omits CVE-2022-23960, a cache speculation restriction vulnerability as it was issued by MITRE and applies to Arm CPUs.
This month’s update includes patches for:
.NET and Visual Studio
.NET Framework
Azure
Azure Arc
Cache Speculation
HTTP.sys
Microsoft Dynamics
Microsoft Edge (Chromium-based)
Microsoft Graphics Component
Microsoft Office
Microsoft Office SharePoint
Microsoft Office Visio
Microsoft Windows ALPC
Microsoft Windows Codecs Library
Network Device Enrollment Service (NDES)
Role: DNS Server
Role: Windows Fax Service
SPNEGO Extended Negotiation
Visual Studio Code
Windows Common Log File System Driver
Windows Credential Roaming Service
Windows Defender
Windows Distributed File System (DFS)
Windows DPAPI (Data Protection Application Programming Interface)
Windows Enterprise App Management
Windows Event Tracing
Windows Group Policy
Windows IKE Extension
Windows Kerberos
Windows Kernel
Windows LDAP – Lightweight Directory Access Protocol
Windows ODBC Driver
Windows OLE
Windows Photo Import API
Windows Print Spooler Components
Windows Remote Access Connection Manager
Windows Remote Procedure Call
Windows TCP/IP
Windows Transport Security Layer (TLS)
Remote code execution (RCE) vulnerabilities accounted for 48.4% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 29%.
CVE-2022-37969 is an EoP vulnerability in the Windows Common Log File System (CLFS) Driver. According to Microsoft, this vulnerability has been exploited in the wild. They also note that it has been publicly disclosed prior to a patch being available.
This is a post-exploitation vulnerability, meaning it can be exploited after an attacker has gained access to a vulnerable target system via other means, including exploiting a separate vulnerability or through social engineering. They could do so using a malicious executable containing exploit code.
CVE-2022-24521, a similar vulnerability in CLFS, was patched earlier this year as part of Microsoft’s April Patch Tuesday release. CVE-2022-24521 flaw was disclosed to Microsoft by the National Security Agency (NSA) and CrowdStrike, which was also exploited in the wild. CVE-2022-37969 has been credited to several groups, including CrowdStrike, though it is unclear at this time if CVE-2022-37969 is potentially a patch-bypass for CVE-2022-24521.
CVE-2022-34718 is a RCE in Windows TCP/IP that received a CVSSv3 score of 9.8 and was rated Exploitation More Likely according to Microsoft’s Exploitability Index. This vulnerability can only be exploited against systems with Internet Protocol Security (IPsec) enabled. Successful exploitation could grant an unauthenticated attacker remote code execution. Microsoft has released patches for all supported versions of Windows, including Server Core editions.
CVE-2022-34721 and CVE-2022-34722 are RCE vulnerabilities in the Windows IKE protocol extensions that received a CVSSv3 score of 9.8 and were rated Exploitation Less Likely. The IKE protocol is a component of IPsec used to set up security associations (relationships among devices based on shared security attributes). These vulnerabilities would allow an unauthenticated, remote attacker to send a specially crafted IP packet to a target with IPsec enabled and achieve remote code execution. IPsec is used to protect sensitive data and is commonly used in virtual private networks. Yuki Chen with Cyber KunLun is credited with disclosing both of these flaws along with CVE-2022-34720, a denial of service flaw in the IKE Protocol Exchange, and CVE-2022-35830, a RCE vulnerability in the Remote Procedure Call runtime.
CVE-2022-37956, CVE-2022-37957 and CVE-2022-37964 are EoP vulnerabilities impacting the Windows Kernel. All three vulnerabilities received CVSSv3 scores of 7.8 and if exploited, could allow an attacker to gain SYSTEM level privileges. Of the three, only CVE-2022-37957 was rated as “Exploitation More Likely.” Curiously, all three impact various versions of Windows. For instance CVE-2022-37964 only affects Windows 7, Windows Server 2008 and 2008 R2. CVE-2022-37956 affects all supported versions of Windows and Windows server, while CVE-2022-37957 only affects Windows 10 and above, including Windows Server versions 2016, 2019 and 2022.
Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains September 2022.
With that filter set, click the plugin families to the left and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:
A list of all the plugins released for Tenable’s September 2022 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.
Microsoft’s September 2022 Security Updates
Tenable plugins for Microsoft September 2022 Patch Tuesday Security Updates
Join Tenable’s Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
The LockBit 3.0 Ransomware as a Service (RaaS) gang has incorporated capabilities of the BlackMatter group into its operations.
The attacks have been underway since early 2021 and appear focused on intelligence gathering
A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8 (SP8). The security vulnerability in SP8 is not remedied after upgrading from SP8 to Service Pack 9 (SP9). HP has released Service Pack 10 (SP10) to remediate the potential vulnerability introduced in SP8.
Some of the Steam accounts stolen were reportedly valued between $100,000 and $300,000
