CVE-2022-29123HighCVSS 6.5

Windows Clustered Shared Volume Information Disclosure Vulnerability

Published
May 10, 2022
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2022-29123 →

📋 Description

According to the CVSS metric, successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability? In this case, a successful attack could be performed from a low privilege AppContainer. The attacker could elevate their privileges and execute code or access resources at a higher integrity level than that of the AppContainer execution environment.

What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is the contents of Kernel memory. An attacker could read the contents of Kernel memory from a user mode process.

🎯 Affected products11

  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2022 (Server Core installation)
  • Windows Server, version 20H2 (Server Core Installation)

✅ Remediation

KB5013941 (Security Update) — fixed build 10.0.17763.2928 KB5013944 (Security Update) — fixed build 10.0.20348.707 KB5013942 (Security Update) — fixed build 10.0.19042.1706 KB5013952 (Security Update) — fixed build 10.0.14393.5125 KB5014017 (Monthly Rollup) — fixed build 6.2.9200.23714 KB5014018 (Security Only) — fixed build 6.2.9200.23714 KB5014011 (Monthly Rollup) — fixed build 6.3.9600.20371 KB5014001 (Security Only) — fixed build 6.3.9600.20365

🔗 References (17)