SB2022101150 - Multiple vulnerabilities in Microsoft Windows Client Server Run-time Subsystem (CSRSS)

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-37987)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Client Server Run-time Subsystem (CSRSS) when performing performing a DOS device redirection. A local user can escalate privileges on the system.

2) Insecure DLL loading (CVE-ID: CVE-2022-37989)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the CSRSS.exe process loads DLL libraries in an insecure manner. A local user can place a specially crafted .dll file on the system and execute arbitrary code with elevated privileges.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37987
• https://www.zerodayinitiative.com/advisories/ZDI-22-1410/
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37989
• https://www.zerodayinitiative.com/advisories/ZDI-22-1413/