SB2022121337 - Multiple vulnerabilities in Microsoft Windows Graphics Component
Published: December 13, 2022 Updated: April 25, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Untrusted Pointer Dereference (CVE-ID: CVE-2022-41121)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper input validation within the StretchBlt and PlgBlt graphics primitives. A local user can run a specially crafted program to trigger an untrusted pointer dereference and execute arbitrary code with SYSTEM privileges.
2) NULL pointer dereference (CVE-ID: CVE-2022-44697)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the win32kfull driver. A local user can run a specially crafted program and perform a denial of service (DoS) attack.
3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-44680)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions in the Windows Graphics Component, which leads to security restrictions bypass and privilege escalation.
4) Information disclosure (CVE-ID: CVE-2022-44679)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in the Windows Graphics Component. A local user can gain unauthorized access to sensitive information on the system.
5) Use-after-free (CVE-ID: CVE-2022-44671)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the GreDrawStream function. A local user can run a specially crafted program to trigger a use-after-free error and execute arbitrary code with SYSTEM privileges.
6) Information disclosure (CVE-ID: CVE-2022-41074)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in the Windows Graphics Component. A local user can gain unauthorized access to sensitive information on the system.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41121
- https://www.zerodayinitiative.com/advisories/ZDI-22-1694/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1693/
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-44697
- https://www.zerodayinitiative.com/advisories/ZDI-22-1675/
- https://www.zerodayinitiative.com/advisories/ZDI-23-476/
- https://www.zerodayinitiative.com/advisories/ZDI-23-475/
- https://www.zerodayinitiative.com/advisories/ZDI-23-474/
- https://www.zerodayinitiative.com/advisories/ZDI-23-473/
- https://www.zerodayinitiative.com/advisories/ZDI-23-472/
- https://www.zerodayinitiative.com/advisories/ZDI-23-471/
- https://www.zerodayinitiative.com/advisories/ZDI-23-470/
- https://www.zerodayinitiative.com/advisories/ZDI-23-469/
- https://www.zerodayinitiative.com/advisories/ZDI-23-468/
- https://www.zerodayinitiative.com/advisories/ZDI-23-467/
- https://www.zerodayinitiative.com/advisories/ZDI-23-466/
- https://www.zerodayinitiative.com/advisories/ZDI-23-465/
- https://www.zerodayinitiative.com/advisories/ZDI-23-464/
- https://www.zerodayinitiative.com/advisories/ZDI-23-463/
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-44680
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-44679
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-44671
- https://www.zerodayinitiative.com/advisories/ZDI-22-1692/
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41074