Microsoft May 2022 Patch Tuesday fixes 3 zero-days, 75 flaws

Today is Microsoft's May 2022 Patch Tuesday, and with it comes fixes for three zero-day vulnerabilities, with one actively exploited, and a total of 75 flaws.

Of the 75 vulnerabilities fixed in today's update, eight are classified as 'Critical' as they allow remote code execution or elevation of privileges.

The number of bugs in each vulnerability category is listed below:

• 21 Elevation of Privilege Vulnerabilities
• 4 Security Feature Bypass Vulnerabilities
• 26 Remote Code Execution Vulnerabilities
• 17 Information Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 1 Spoofing Vulnerability
• 0 Edge - Chromium Vulnerabilities

For information about the non-security Windows updates, you can read about today's Windows 10 KB5013942 and KB5013945 updates and the Windows 11 KB5013943 update.

Three zero-days fixed, two actively exploited

This month's Patch Tuesday includes fixes for three zero-day vulnerabilities, with one actively exploited and the others publicly disclosed.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The actively exploited zero-day vulnerability fixed today is for a new NTLM Relay Attack using an LSARPC flaw tracked as 'CVE-2022-26925 - Windows LSA Spoofing Vulnerability.'

"An unauthenticated attacker could call a method on the LSARPC interface and coerce the domain controller to authenticate to the attacker using NTLM. This security update detects anonymous connection attempts in LSARPC and disallows it," explains Microsoft in an advisory published today.

Using this attack, threat actors can intercept legitimate authentication requests and use them to gain elevated privileges, even as far as assuming the identity of a domain controller.

Microsoft recommends admins read the PetitPotam NTLM Relay advisory for information on how to mitigate these types of attacks.

The two publicly exposed zero-days are a denial of service vulnerability in Hyper-V and a new remote code execution vulnerability in Azure Synapse and Azure Data Factory.

• CVE-2022-22713 - Windows Hyper-V Denial of Service Vulnerability
• CVE-2022-29972 - Insight Software: CVE-2022-29972 Magnitude Simba Amazon Redshift ODBC Driver

Now that Microsoft has issued patches for these vulnerabilities, admins should expect that threat actors will analyze the security updates to see what has changed. Then, using this information, they will create their own exploits to use in attacks

Therefore, it is strongly advised to install today's security updates as soon as possible.

Recent updates from other companies

Other vendors who released updates in May 2022 include:

• Google released Android's May security updates, as well as updates for ChromOS and Chrome.
• Cisco released security updates for numerous products this month.
• F5 released BIG-IP security updates to fix an actively exploited critical vulnerability.

The May 2022 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities and released advisories in the May 2022 Patch Tuesday updates. To access the full description of each vulnerability and the systems that it affects, you can view the full report here.