Windows Kerberos, Hyper-V vulns among January Patch Tuesday bugs

Microsoft has released a total of 49 new patches marking the first Patch Tuesday event of 2024, addressing a variety of vulnerabilities across its product estate, among them two critical bugs affecting Windows Kerberos and Windows Hyper-V, but no zero-days or Exchange issues.

This is the second relatively light Patch Tuesday drop on the jump – Microsoft having addressed barely 30 issues in December 2023, and no zero-day issues to trouble security teams and sysadmins then, either.

The two critical vulnerabilities are tracked as CVE-2024-20674 in Windows Kerberos and CVE-2024-20700 in Windows Hyper-V.

The first of these is a security feature bypass flaw that can be taken advantage of through a so-called man-in-the-middle (MITM) attack, or another method of network spoofing, then sending a malicious Kerberos message to the victim machine pretending to be the legitimate Kerberos authentication server, and from there gain additional privileges on restricted systems.

“The vulnerability requires the attacker to have access to the same local network as the target,” said Saeed Abbasi, product manager for vulnerability research at the Qualys Threat Research Unit. “It’s not remotely exploitable over the internet but requires proximity to the internal network.

“Also, this breach can spread to areas not directly managed by the compromised system’s security protocols. There is a high likelihood of active exploitation attempts in the near future.

“Beyond standard patching, consider enhancing network monitoring capabilities,” said Abbasi. “Look for unusual patterns or anomalies in network traffic that could indicate a MITM attack or unauthorised Kerberos traffic.”

The second critical vulnerability is a remote code execution (RCE) flaw, which is rather more vaguely described by Microsoft and appears to be harder to exploit, as it hinges on a threat actor winning a race condition to successfully take advantage of it, although from then on it needs no further privileges or user interaction.

Mike Walters, president and co-founder of Action1, said the vulnerability had implications for the confidentiality, integrity and availability of the targeted system.

“Exploitation could enable an attacker to run arbitrary code with the privileges of the Hyper-V host, potentially compromising the entire system,” he said.

“[But] as of the initial publication, there has been no public disclosure or confirmed instances of this vulnerability being exploited. The maturity of any exploit code remains unproven.”