Microsoft October 2022 Patch Tuesday fixes zero-day used in attacks, 84 flaws

Microsoft’s October 2022 Patch Tuesday, and with it comes fixes for an actively exploited Windows vulnerability and a total of 84 flaws.

Thirteen of the 84 vulnerabilities fixed in today’s update are classified as ‘Critical’ as they allow privilege elevation, spoofing, or remote code execution, one of the most severe types of vulnerabilities.

The number of bugs in each vulnerability category is listed below:

  • 39 Elevation of Privilege Vulnerabilities
  • 2 Security Feature Bypass Vulnerabilities
  • 20 Remote Code Execution Vulnerabilities
  • 11 Information Disclosure Vulnerabilities
  • 8 Denial of Service Vulnerabilities
  • 4 Spoofing Vulnerabilities

The above counts do not include twelve vulnerabilities fixed in Microsoft Edge on October 3rd.

Two zero-days fixed, one actively exploited

This month’s Patch Tuesday fixes two publicly zero-day vulnerabilities, one actively exploited in attacks and one publicly disclosed.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The actively exploited zero-day vulnerability fixed today is tracked as ‘CVE-2022-41033 – Windows COM+ Event System Service Elevation of Privilege Vulnerability.’

“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” reads Microsoft’s advisory.

The exploited vulnerability is listed as discovered by an ‘Anonymous’ researcher.

The publicly disclosed vulnerability is tracked as ‘CVE-2022-41043 – Microsoft Office Information Disclosure Vulnerability’ and was discovered by Cody Thomas of SpecterOps.

Microsoft says attackers could use this vulnerability to gain access to users’ authentication tokens.

Microsoft Exchange zero-days not fixed

Unfortunately, Microsoft has not released security updates for two actively exploited zero-day vulnerabilities tracked as CVE-2022-41040 and CVE-2022-41082, also dubbed to ProxyNotShell.

These vulnerabilities were disclosed in late September by Vietnamese cybersecurity outfit GTSC, who first spotted and reported the attacks.

The vulnerabilities were disclosed to Microsoft through Trend Micro’s Zero Day Initiative and were expected to be fixed today.

However, today’s Microsoft Exchange security bulletin states that the fixes are not ready.

“The October 2022 SUs do not contain fixes for the zero-day vulnerabilities reported publicly on September 29, 2022 (CVE-2022-41040 and CVE-2022-41082),” reads the Microsoft Exchange bulletin.

“Please see this blog post to apply mitigations for those vulnerabilities. We will release updates for CVE-2022-41040 and CVE-2022-41082 when they are ready.”

Recent updates from other companies

Other vendors who released updates in October 2022 include:

The October 2022 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities and released advisories in the October 2022 Patch Tuesday updates. To access the full description of each vulnerability and the systems that it affects.,

TagCVE IDCVE TitleSeverity
Active Directory Domain ServicesCVE-2022-38042Active Directory Domain Services Elevation of Privilege VulnerabilityImportant
AzureCVE-2022-38017StorSimple 8000 Series Elevation of Privilege VulnerabilityImportant
Azure ArcCVE-2022-37968Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege VulnerabilityCritical
Client Server Run-time Subsystem (CSRSS)CVE-2022-37987Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityImportant
Client Server Run-time Subsystem (CSRSS)CVE-2022-37989Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityImportant
Microsoft Edge (Chromium-based)CVE-2022-3311Chromium: CVE-2022-3311 Use after free in ImportUnknown
Microsoft Edge (Chromium-based)CVE-2022-3313Chromium: CVE-2022-3313 Incorrect security UI in Full ScreenUnknown
Microsoft Edge (Chromium-based)CVE-2022-3315Chromium: CVE-2022-3315 Type confusion in BlinkUnknown
Microsoft Edge (Chromium-based)CVE-2022-3370Chromium: CVE-2022-3370 Use after free in Custom ElementsUnknown
Microsoft Edge (Chromium-based)CVE-2022-3373Chromium: CVE-2022-3373 Out of bounds write in V8Unknown
Microsoft Edge (Chromium-based)CVE-2022-3316Chromium: CVE-2022-3316 Insufficient validation of untrusted input in Safe BrowsingUnknown
Microsoft Edge (Chromium-based)CVE-2022-3317Chromium: CVE-2022-3317 Insufficient validation of untrusted input in IntentsUnknown
Microsoft Edge (Chromium-based)CVE-2022-3310Chromium: CVE-2022-3310 Insufficient policy enforcement in Custom TabsUnknown
Microsoft Edge (Chromium-based)CVE-2022-3304Chromium: CVE-2022-3304 Use after free in CSSUnknown
Microsoft Edge (Chromium-based)CVE-2022-41035Microsoft Edge (Chromium-based) Spoofing VulnerabilityModerate
Microsoft Edge (Chromium-based)CVE-2022-3308Chromium: CVE-2022-3308 Insufficient policy enforcement in Developer ToolsUnknown
Microsoft Edge (Chromium-based)CVE-2022-3307Chromium: CVE-2022-3307 Use after free in MediaUnknown
Microsoft Graphics ComponentCVE-2022-37986Windows Win32k Elevation of Privilege VulnerabilityImportant
Microsoft Graphics ComponentCVE-2022-38051Windows Graphics Component Elevation of Privilege VulnerabilityImportant
Microsoft Graphics ComponentCVE-2022-37997Windows Graphics Component Elevation of Privilege VulnerabilityImportant
Microsoft Graphics ComponentCVE-2022-37985Windows Graphics Component Information Disclosure VulnerabilityImportant
Microsoft Graphics ComponentCVE-2022-33635Windows GDI+ Remote Code Execution VulnerabilityImportant
Microsoft OfficeCVE-2022-38001Microsoft Office Spoofing VulnerabilityImportant
Microsoft OfficeCVE-2022-38048Microsoft Office Remote Code Execution VulnerabilityCritical
Microsoft OfficeCVE-2022-41043Microsoft Office Information Disclosure VulnerabilityImportant
Microsoft Office SharePointCVE-2022-38053Microsoft SharePoint Server Remote Code Execution VulnerabilityImportant
Microsoft Office SharePointCVE-2022-41036Microsoft SharePoint Server Remote Code Execution VulnerabilityImportant
Microsoft Office SharePointCVE-2022-41038Microsoft SharePoint Server Remote Code Execution VulnerabilityCritical
Microsoft Office SharePointCVE-2022-41037Microsoft SharePoint Server Remote Code Execution VulnerabilityImportant
Microsoft Office WordCVE-2022-41031Microsoft Word Remote Code Execution VulnerabilityImportant
Microsoft Office WordCVE-2022-38049Microsoft Office Graphics Remote Code Execution VulnerabilityImportant
Microsoft WDAC OLE DB provider for SQLCVE-2022-37982Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityImportant
Microsoft WDAC OLE DB provider for SQLCVE-2022-38031Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityImportant
NuGet ClientCVE-2022-41032NuGet Client Elevation of Privilege VulnerabilityImportant
Remote Access Service Point-to-Point Tunneling ProtocolCVE-2022-37965Windows Point-to-Point Tunneling Protocol Denial of Service VulnerabilityImportant
Role: Windows Hyper-VCVE-2022-37979Windows Hyper-V Elevation of Privilege VulnerabilityCritical
Service FabricCVE-2022-35829Service Fabric Explorer Spoofing VulnerabilityImportant
Visual Studio CodeCVE-2022-41042Visual Studio Code Information Disclosure VulnerabilityImportant
Visual Studio CodeCVE-2022-41034Visual Studio Code Remote Code Execution VulnerabilityImportant
Visual Studio CodeCVE-2022-41083Visual Studio Code Elevation of Privilege VulnerabilityImportant
Windows Active Directory Certificate ServicesCVE-2022-37978Windows Active Directory Certificate Services Security Feature BypassImportant
Windows Active Directory Certificate ServicesCVE-2022-37976Active Directory Certificate Services Elevation of Privilege VulnerabilityCritical
Windows ALPCCVE-2022-38029Windows ALPC Elevation of Privilege VulnerabilityImportant
Windows CD-ROM DriverCVE-2022-38044Windows CD-ROM File System Driver Remote Code Execution VulnerabilityImportant
Windows COM+ Event System ServiceCVE-2022-41033Windows COM+ Event System Service Elevation of Privilege VulnerabilityImportant
Windows Connected User Experiences and TelemetryCVE-2022-38021Connected User Experiences and Telemetry Elevation of Privilege VulnerabilityImportant
Windows CryptoAPICVE-2022-34689Windows CryptoAPI Spoofing VulnerabilityCritical
Windows DefenderCVE-2022-37971Microsoft Windows Defender Elevation of Privilege VulnerabilityImportant
Windows DHCP ClientCVE-2022-38026Windows DHCP Client Information Disclosure VulnerabilityImportant
Windows DHCP ClientCVE-2022-37980Windows DHCP Client Elevation of Privilege VulnerabilityImportant
Windows Distributed File System (DFS)CVE-2022-38025Windows Distributed File System (DFS) Information Disclosure VulnerabilityImportant
Windows DWM Core LibraryCVE-2022-37970Windows DWM Core Library Elevation of Privilege VulnerabilityImportant
Windows DWM Core LibraryCVE-2022-37983Microsoft DWM Core Library Elevation of Privilege VulnerabilityImportant
Windows Event Logging ServiceCVE-2022-37981Windows Event Logging Service Denial of Service VulnerabilityImportant
Windows Group PolicyCVE-2022-37975Windows Group Policy Elevation of Privilege VulnerabilityImportant
Windows Group Policy Preference ClientCVE-2022-37994Windows Group Policy Preference Client Elevation of Privilege VulnerabilityImportant
Windows Group Policy Preference ClientCVE-2022-37993Windows Group Policy Preference Client Elevation of Privilege VulnerabilityImportant
Windows Group Policy Preference ClientCVE-2022-37999Windows Group Policy Preference Client Elevation of Privilege VulnerabilityImportant
Windows Internet Key Exchange (IKE) ProtocolCVE-2022-38036Internet Key Exchange (IKE) Protocol Denial of Service VulnerabilityImportant
Windows KernelCVE-2022-37988Windows Kernel Elevation of Privilege VulnerabilityImportant
Windows KernelCVE-2022-38037Windows Kernel Elevation of Privilege VulnerabilityImportant
Windows KernelCVE-2022-37990Windows Kernel Elevation of Privilege VulnerabilityImportant
Windows KernelCVE-2022-38038Windows Kernel Elevation of Privilege VulnerabilityImportant
Windows KernelCVE-2022-38039Windows Kernel Elevation of Privilege VulnerabilityImportant
Windows KernelCVE-2022-37995Windows Kernel Elevation of Privilege VulnerabilityImportant
Windows KernelCVE-2022-37991Windows Kernel Elevation of Privilege VulnerabilityImportant
Windows KernelCVE-2022-38022Windows Kernel Elevation of Privilege VulnerabilityImportant
Windows Local Security Authority (LSA)CVE-2022-38016Windows Local Security Authority (LSA) Elevation of Privilege VulnerabilityImportant
Windows Local Security Authority Subsystem Service (LSASS)CVE-2022-37977Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityImportant
Windows Local Session Manager (LSM)CVE-2022-37973Windows Local Session Manager (LSM) Denial of Service VulnerabilityImportant
Windows Local Session Manager (LSM)CVE-2022-37998Windows Local Session Manager (LSM) Denial of Service VulnerabilityImportant
Windows NTFSCVE-2022-37996Windows Kernel Memory Information Disclosure VulnerabilityImportant
Windows NTLMCVE-2022-35770Windows NTLM Spoofing VulnerabilityImportant
Windows ODBC DriverCVE-2022-38040Microsoft ODBC Driver Remote Code Execution VulnerabilityImportant
Windows Perception Simulation ServiceCVE-2022-37974Windows Mixed Reality Developer Tools Information Disclosure VulnerabilityImportant
Windows Point-to-Point Tunneling ProtocolCVE-2022-33634Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityCritical
Windows Point-to-Point Tunneling ProtocolCVE-2022-22035Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityCritical
Windows Point-to-Point Tunneling ProtocolCVE-2022-24504Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityCritical
Windows Point-to-Point Tunneling ProtocolCVE-2022-38047Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityCritical
Windows Point-to-Point Tunneling ProtocolCVE-2022-41081Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityCritical
Windows Point-to-Point Tunneling ProtocolCVE-2022-30198Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityCritical
Windows Point-to-Point Tunneling ProtocolCVE-2022-38000Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityCritical
Windows Portable Device Enumerator ServiceCVE-2022-38032Windows Portable Device Enumerator Service Security Feature Bypass VulnerabilityImportant
Windows Print Spooler ComponentsCVE-2022-38028Windows Print Spooler Elevation of Privilege VulnerabilityImportant
Windows Resilient File System (ReFS)CVE-2022-38003Windows Resilient File System Elevation of PrivilegeImportant
Windows Secure ChannelCVE-2022-38041Windows Secure Channel Denial of Service VulnerabilityImportant
Windows Security Support Provider InterfaceCVE-2022-38043Windows Security Support Provider Interface Information Disclosure VulnerabilityImportant
Windows Server Remotely Accessible Registry KeysCVE-2022-38033Windows Server Remotely Accessible Registry Keys Information Disclosure VulnerabilityImportant
Windows Server ServiceCVE-2022-38045Server Service Remote Protocol Elevation of Privilege VulnerabilityImportant
Windows StorageCVE-2022-38027Windows Storage Elevation of Privilege VulnerabilityImportant
Windows TCP/IPCVE-2022-33645Windows TCP/IP Driver Denial of Service VulnerabilityImportant
Windows USB Serial DriverCVE-2022-38030Windows USB Serial Driver Information Disclosure VulnerabilityImportant
Windows Web Account ManagerCVE-2022-38046Web Account Manager Information Disclosure VulnerabilityImportant
Windows Win32KCVE-2022-38050Win32k Elevation of Privilege VulnerabilityImportant
Windows WLAN ServiceCVE-2022-37984Windows WLAN Service Elevation of Privilege VulnerabilityImportant
Windows Workstation ServiceCVE-2022-38034Windows Workstation Service Elevation of Privilege VulnerabilityImportant

Original Posts: Microsoft October 2022 Patch Tuesday fixes zero-day used in attacks, 84 flaws