Akamai’s Perspective on January’s Patch Tuesday 2023
Microsoft’s Patch Tuesday for January 2023 has been released, and we at Akamai Security Intelligence Group set out to look at the more intriguing vulnerabilities that were patched. It seems Microsoft entered the new year with renewed vigor, as there are nearly twice the CVEs patched this month than in December. Akamai Security Intelligence Group also entered the year strongly; we disclosed two of the vulnerabilities patched this month — see a short description of them below.
In this report, we’ll assess how critical the vulnerabilities really are and how commonplace the affected applications and services are, and we’ll provide a realistic perspective on the bugs that were fixed. Be on the lookout for these insights in the days after every Patch Tuesday.
This is an updating report and we’ll add more information to it as our research progresses — stay tuned!
In addition to the security vulnerabilities disclosed by Akamai, in this report, we’re focusing on the following areas in which bugs were patched:
Security vulnerabilities disclosed by Akamai
The following two vulnerabilities were disclosed responsibly to Microsoft and addressed in this month's patch. We’ll provide more details on those vulnerabilities once more time has passed, to give everyone a chance to patch their systems. For now, we can give a short description.
SMB Witness service remote EoP
CVE-2023-21549, CVSS score 8.8
This is another vulnerability found through our RPC Toolkit. The SMB Service Witness Protocol is used as part of SMB clustered file servers.
LSM local EoP
CVE-2023-21771, CVSS score 7.0
This is another vulnerability in one of LSM RPC interfaces. The vulnerability is only locally triggerable, and exploitation requires winning a race condition that is easily achieved.
As the vulnerable function does not exist on every Windows build, only the following versions are vulnerable:
Windows Server 2022
Windows 10 versions 21H2 and 22H2
Windows 11 versions 21H2 and 22H2
Windows Layer 2 Tunneling Protocol
The Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol used to support VPNs. In Windows, it is part of the Remote Access Server (RAS), similarly to SSTP and PPP (which were covered in previous months). Remote access is a Windows Server role that allows remote clients to connect to the LAN, similar to a VPN. The server role needs to be actively added.
There are five critical vulnerabilities in this service this month, all of them with a CVSS score 8.1 and allow for remote code execution.
Four of the vulnerabilities (CVE-2023-21546, CVE-2023-21679, CVE-2023-21555 and CVE-2023-21556) require the attacker to win a race condition to trigger them. The other CVE, CVE-2023-21543, doesn’t require a race condition according to the Microsoft Security Response Center (MSRC), but does require the attacker to perform additional steps prior to the exploitation.
We can’t have downtime on our VPN server. Can we do some type of mitigation other than patching?
Since L2TP is used to support VPN servers, it is practically impossible to restrict internet access to it. Therefore, there aren’t many mitigation options available outside of patching. If you know that you don’t have workers in certain parts of the world (for example, all your employees are in the United States), you might restrict access from certain geolocations based on geo-ip, but that task is very hard to contain as well.
Alternatively, since all the CVEs require race conditions or extra steps, it is safe to assume that their exploitation will result in a spike in network activity. Monitoring network activity might yield alerts on potential exploitation attempts.
Windows Lightweight Directory Access Protocol
The Lightweight Directory Access Protocol (LDAP) is an open source protocol designed for connecting and querying directory services and databases. Active Directory’s domain controller has an LDAP server implementation to allow existing programs and servers that rely on LDAP to use the existing AD without requiring a separate server.
This month, there are two vulnerabilities in the LDAP service, affecting unpatched domain controllers. CVE-2023-21557 is a denial-of-service (DoS) vulnerability that can be done prior to authentication. MSRC’s advisory also states that successfully exploiting the vulnerability could also result in an information disclosure, but doesn’t specify what data is leaked. CVE-2023-21676 is a remote code execution vulnerability, though it requires prior authentication.
We can’t patch our domain controller and risk down time. Can the vulnerabilities be mitigated elsewhere?
Not really. Since the domain controller is integral to all parts of the domain, it is practically impossible to restrict access to it without compromising normal network operations. Since CVE-2023-21676 requires an authenticated user, it might help IR teams when tracing it (but will not really help with preemptive prevention).
Microsoft Cryptographic Services
The name Cryptographic Services is a bit cryptic, as there are many parts of the operating system to which it can refer. (It should refer to only one — CryptSvc, the literal Cryptographic Service — but its file wasn’t patched.) There is only one CVE that says which part of the system is affected — CVE-2023-21561 with CSRSS.
There are six CVEs this month, three for local elevation of privilege and three for local information disclosure. These vulnerabilities affect all Windows machines, whether they are servers or desktops, so patching is paramount.
CVE Number |
Effect |
|---|---|
| CVE-2023-21561 | Elevation of privilege from AppContainer to SYSTEM |
| CVE-2023-21730 | Elevation of privilege to SYSTEM |
| CVE-2023-21551 | |
| CVE-2023-21559 | Disclosure of Windows cryptographic secrets |
| CVE-2023-21540 | |
| CVE-2023-21550 |
Previously covered services
Many CVEs in this month’s Patch Tuesday are for systems that we already covered in the past. If you’re interested in our analysis of or general recommendations for those services, we encourage you to look at our previous posts.
Service |
CVE Number |
Effect |
Required Access |
|---|---|---|---|
Authentication bypass |
Network |
||
Remote code execution |
Authenticated as at least a Site Member |
||
Authenticated with page creation privilege |
|||
Remote code execution |
Network |
||
Information disclosure |
Network |
This summary provides an overview of our current understanding and our recommendations given the information available. Our review is ongoing and any information herein is subject to change.