CVE-2022-26809CriticalCVSS 9.8

Remote Procedure Call Runtime Remote Code Execution Vulnerability

Published
April 12, 2022
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2022-26809 →

📋 Description

How could an attacker exploit this vulnerability? To exploit this vulnerability, an unauthenticated attacker would need to send a specially crafted RPC call to an RPC host. This could result in remote code execution on the server side with the same permissions as the RPC service.

Why did Microsoft remove the Mitigation to “Block TCP port 445 at the enterprise perimeter firewall”? The researcher who submitted the vulnerability used SMB as the attack vector to trigger the exploit in the RPC service, so the mitigation was effective for the issue that was presented to us. Although blocking ports 139 and 445 [SMB] at the perimeter firewall is a recommended practice, it does not directly protect against all potential attack scenarios for this specific vulnerability. At this time we are not aware of any other specific attack vectors for this vulnerability, and continue to encourage users to: Apply the April 2022 security updates to fully address this issue. Follow Microsoft guidelines to secure SMB traffic. See Secure SMB Traffic in Windows Server. The vulnerability is in RPC, not SMB. Should I also block RPC? The known attack that was presented to Microsoft does not use TCP Port 135 to initiate an exploit but, as the vulnerability is in RPC, blocking TCP port 135 at the enterprise perimeter firewall is a recommended best practice that would reduce the likelihood of other potential attacks against this vulnerability.

🎯 Affected products42

  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 11 version 21H2 for x64-based Systems
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 8.1 for 32-bit systems
  • Windows 8.1 for x64-based systems
  • Windows RT 8.1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • +12 more not shown

✅ Remediation

KB5012647 (Security Update) — fixed build 10.0.17763.2803 KB5012591 (Security Update) — fixed build 10.0.18363.2212 KB5012599 (Security Update) — fixed build 10.0.19043.1645 KB5012604 (Security Update) — fixed build 10.0.20348.643 KB5012599 (Security Update) — fixed build 10.0.19042.1645 KB5012592 (Security Update) — fixed build 10.0.22000.613 KB5012599 (Security Update) — fixed build 10.0.19044.1645 KB5012653 (Security Update) — fixed build 10.0.10240.19265 KB5012596 (Security Update) — fixed build 10.0.14393.5066 KB5012626 (Monthly Rollup) — fixed build 6.1.7601.25924 KB5012649 (Security Only) — fixed build 6.1.7601.25924 KB5012670 (Monthly Rollup) — fixed build 6.3.9600.20337 KB5012639 (Security Only) — fixed build 6.3.9600.20337 KB5012658 (Monthly Rollup) — fixed build 6.0.6003.21446 KB5012632 (Security Only) — fixed build 6.0.6003.21446 KB5012650 (Monthly Rollup) — fixed build 6.2.9200.23679 KB5012666 (Security Only) — fixed build 6.2.9200.23679

🔗 References (31)