According to the CVSS metrics, successful exploitation of this vulnerability does not impact confidentiality (C:N), but has major impact on integrity (I:H) and availability (A:H). What does that mean for this vulnerability?

Exploitation of this vulnerability does not disclose any confidential information but allows an attacker to modify or delete files containing data which could cause the service to become unavailable.

What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could create, modify, or delete files in the security context of the NT AUTHORITY\SYSTEM account.

What actions do customers need to take to protect themselves from this vulnerability?

Customers who have disabled Automatic Extension Upgrades or would like to upgrade an extension immediately must manually update their Azure Monitor Agent to the latest version. For more information on how to perform a manual update, see Manage Azure Monitor Agent.

Information published.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Information published.

According to the CVSS metric, successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

Successful exploitation of this vulnerability could allow an attacker to perform operations in the victim's hybrid cloud environment with the same privileges as the compromised managed identity.

What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could gain the privileges of the compromised managed identity.

How could an attacker exploit this vulnerability?

An attacker with basic user privileges could compromise an unencrypted service principal for a managed identity and perform service management operations on other resources in the hybrid environment the managed identity is permitted to manage.

Information published.

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.

Information published.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

An attacker is required to compromise the credential of a victim who has been assigned the role of “Cluster Admin” or “Cluster Operator” by an administrator prior to attempting to exploit the vulnerability.

According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires the attacker or targeted user to have specific elevated privileges. Only users with roles “Cluster Admin” and “Cluster Operator” can access this.

Information published.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.

Information published.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.

Information published.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), have no effect on integrity (I:N) and have a high impact on availability (A:H). What does that mean for this vulnerability?

This vulnerability could allow an attacker to disclose confidential information or make the service unavailable but does not allow the attacker to modify any data.

Information published.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Information published.

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.

Information published.

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.

Information published.

Information published.

What type of information could be disclosed by this vulnerability?

An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory.

Information published.

Is there a prerequisite for installing the security update?

Yes. For Windows Server 2012 R2 only, to apply this update, you must have KB2919355 installed.

Are there additional steps that I need to take to be protected from this vulnerability?

Depending on the version of Windows you are running, you may need to take additional steps to update Windows Recovery Environment (WinRE) to be protected from this vulnerability.

For the latest version of Windows the process of updating WinRE is now fully automated. The following versions of Windows require no additional steps as WinRE will be updated as a part of the Latest Cumulative Update if you are getting updates from Windows Update and WSUS.:

• Windows 11 Version 23H2 for x64-based Systems
• Windows 11 Version 23H2 for ARM64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems

For the following versions of Windows, the Windows Recovery Environment updates listed are available. These updates automatically apply the latest Safe OS Dynamic Update to WinRE from the running Windows OS:

• Windows Server 2022 (Server Core installation) (KB5046399: Windows Recovery Environment update for Azure Stack HCI, version 22H2 and Windows Server 2022: October 8, 2024)
• Windows Server 2022 (KB5046399: Windows Recovery Environment update for Azure Stack HCI, version 22H2 and Windows Server 2022: October 8, 2024)
• Windows Server 2022, 23H2 Edition (Server Core installation) (KB5046399: Windows Recovery Environment update for Azure Stack HCI, version 22H2 and Windows Server 2022: October 8, 2024)
• Windows 11 version 21H2 for x64-based Systems (KB5046398: Windows Recovery Environment update for Windows 11, version 21H2: October 8, 2024)
• Windows 10 Version 22H2 for x64-based Systems (KB5046400: Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: October 8, 2024)
• Windows 10 Version 22H2 for 32-bit Systems (KB5046400: Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: October 8, 2024)
• Windows 10 Version 21H2 for x64-based Systems (KB5046400: Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: October 8, 2024)
• Windows 10 Version 21H2 for 32-bit Systems (KB5046400: Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: October 8, 2024)

As an alternative to updates provided in the preceding list or if your version of Windows is not listed in the list, you can download the latest Windows Safe OS Dynamic Update from the Microsoft Update Catalog. You can then apply the WinRE update. See  Add an update package to Windows RE. To automate your installation Microsoft has developed a sample script that can help with updating WinRE from the running Windows OS. Please see KB5034957: Updating the WinRE partition on deployed devices to address security vulnerabilities in CVE-2024-20666 for more information.

How do I check whether WinRE has successfully updated?

Use DISM /Get-Packages on a mounted WinRE image to ensure latest Safe OS Dynamic Update package is present. For more information, see Check the WinRE image version.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to physically access the target device. To gain access, an attacker must acquire the device after being unlocked by a legitimate user (target of opportunity) or possess the ability to pass device authentication or password protection mechanisms.

Are there additional steps that I need to take to be protected from this vulnerability?

Yes. You must apply the applicable Windows security update to your Windows Recovery Environment (WinRE). For more information about how to apply the WinRE update, see Add an update package to Windows RE.

IMPORTANT: End users and enterprises who are updating Windows devices which are already deployed in their environment can instead use the latest Windows Safe OS Dynamic Updates to update WinRE when the partition is too small to install the full Windows update. You can download the latest Windows Safe OS Dynamic Update from the Microsoft Update Catalog.

Information published.

Information published.

According to the CVSS metric, user interaction is required (UI:R) and privileges required are none (PR:N). What does that mean for this vulnerability?

An unauthorized attacker must wait for a user to initiate a connection.

According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?

This attack requires an admin user on the client to connect to a malicious server, and that could allow the attacker to gain code execution on the client.

How could an attacker exploit this vulnerability?

An attacker could exploit the vulnerability by remotely managing another machine's Telephony server using the tapisnap.dll tool. This could result in a heap-based buffer out-of-bounds write due to malicious data returned by the Telephony server's RPC interface.

Information published.

According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?

An authenticated victim who is connected to the network must be tricked or persuaded to connect to a malicious SQL database using their SQL client application. After the connection is made, the server can send specially crafted replies to the client that exploit the vulnerability and permit execution of arbitrary code within the context of the user's SQL client application.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

An attacker could exploit the vulnerability by tricking an authenticated user (CVSS metric UI:R) into attempting to connect to a malicious SQL server via a connection driver (for example: ODBC and / or OLEDB as applicable).

Information published.

According to the CVSS metric, the Attack Vector is Physical (AV:P). What does that mean for this vulnerability?

An attacker needs physical access to the target computer to plug in a malicious USB drive.

Information published.

According to the CVSS metric, the Attack Vector is Physical (AV:P). What does that mean for this vulnerability?

An attacker needs physical access to the target computer to plug in a malicious USB drive.

Information published.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Information published.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

A user with low privileges would need to initiate an RPC call to the print spooler which runs as SYSTEM.

Information published.

How could an attacker exploit the vulnerability?

To exploit this vulnerability, an attacker could execute a specially crafted malicious script which executes an RPC call to an RPC host. This could result in elevation of privilege on the server.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Information published.

How could an attacker exploit this vulnerability?

In the case of a Remote Desktop connection, an attacker with control of a Remote Desktop Server could trigger a remote code execution (RCE) on the RDP client machine when a victim connects to the attacking server with the vulnerable Remote Desktop Client.

Information published.

What type of information could be disclosed by this vulnerability?

An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

An attacker must send the user a malicious file and convince them to open it.

Information published.