December 2024 Patch Tuesday: 16 Critical and One Zero-Day Among 71 Vulnerabilities

Microsoft has released security updates for 71 vulnerabilities in its December 2024 Patch Tuesday rollout. Among these are 16 Critical vulnerabilities and one zero-day affecting the Windows Common Log File System (CVE-2024-49138). The zero-day was identified by the CrowdStrike Counter Adversary Operations’ Advanced Research Team.

December 2024 Risk Analysis

This month’s leading risk type by exploitation technique is remote code execution (RCE) with 42%, followed by elevation of privilege (38%).

Zero-Day Vulnerability (CVE-2024-49138) Exploit Observed in the Wild 

CVE-2024-49138 is a privilege escalation vulnerability within the Microsoft Windows Common Log File System (CLFS) driver, categorized as Important in severity. CrowdStrike Counter Adversary Operations discovered and privately reported this vulnerability to Microsoft, which subsequently acknowledged, patched and confirmed its active exploitation in the wild.

Three Critical Vulnerabilities in Lightweight Directory Access Protocol (LDAP) Client

CVE-2024-49112 is a Critical RCE vulnerability affecting the Windows LDAP Client with a CVSS score of 9.8. This vulnerability could allow an unprivileged attacker to run arbitrary code on an Active Directory Server by sending a specialized set of LDAP calls to the server. Microsoft recommends that all Active Directory servers be configured to not accept Remote Procedure Calls (RPCs) from untrusted networks in addition to patching this vulnerability. Due to the ease of exploitation and the significant risk this vulnerability poses to the Active Directory environment, it should be mitigated and patched quickly. 

CVE-2024-49124 is a Critical RCE vulnerability affecting the Windows LDAP Client with a CVSS score of 8.1. Successful exploitation of this vulnerability would allow an unauthenticated remote attacker to use a specially crafted packet to leverage a cryptographic protocol within Windows Kerberos to carry out RCE. 

CVE-2024-49127 is a Critical RCE vulnerability in the Windows LDAP Client with a CVSS score of 8.1. An unauthenticated attacker could send a specially crafted request to a vulnerable server. Successful exploitation of this vulnerability requires an attacker to win a race condition, which could then allow the attacker to execute code in the SYSTEM account.

A Critical Vulnerability in Windows Hyper-V

CVE-2024-49117 is a Critical RCE vulnerability affecting Windows Hyper-V with a CVSS score of 8.8. This vulnerability would require an authenticated attacker on a guest virtual machine (VM) to send specially crafted file operation requests on the VM to hardware resources on the VM, which could result in RCE on the host server. This vulnerability, while described as "remote," actually requires local access to exploit. It allows arbitrary code execution, but the vulnerable endpoint is only accessible through the local VM interface, meaning an attacker must already have access to the local machine to carry out the attack.

Two Critical Vulnerabilities in Microsoft Message Queueing 

CVE-2024-49118 and CVE-2024-49122 are Critical RCE vulnerabilities affecting Microsoft Message Queuing (MSMQ) and both have a CVSS score of 8.1. Successful exploitation of these vulnerabilities requires an attacker to win a race condition. An attacker would need to send a specially crafted malicious MSMQ packet to a MSMQ server. This could result in RCE on the server side.

MSMQ has been highlighted in past CrowdStrike Patch Tuesday blogs and continues to see vulnerabilities disclosed. MSMQ represents an attractive target for attackers due to its prevalent use of high-availability services such as Active Directory. The Windows message queuing service needs to be enabled, and network traffic allowed on TCP port 1801, for an attacker to successfully exploit this vulnerability on a target system. In addition to patching, Microsoft recommends checking if the “Message Queuing” service is running and TCP port 1801 is listening on the machine; if the service is running and not being utilized, consider disabling.

A Critical Vulnerability in Windows Local Security Authority Subsystem Service (LSASS)

CVE-2024-49126 is a Critical RCE vulnerability affecting Windows Local Security Authority Subsystem Service (LSASS) with a CVSS score of 8.1. Successful exploitation of this vulnerability requires an attacker to win a race condition. This vulnerability allows an attacker to remotely execute arbitrary code on a server without requiring special privileges or user interaction. The attacker can exploit this weakness through a network call, potentially gaining control over the server by running malicious code in the context of the server's account.

Nine Critical Vulnerabilities in Windows Remote Desktop Services

The following nine vulnerabilities are Critical RCE vulnerabilities affecting Windows Remote Desktop Services, and all have a CVSS score of 8.1. An attacker could successfully exploit these vulnerabilities by connecting to a system with the Remote Desktop Gateway role, triggering a race condition to create a use-after-free scenario, and then leveraging this to execute arbitrary code.

Not All Relevant Vulnerabilities Have Patches: Consider Mitigation Strategies

As we have learned with other notable vulnerabilities, such as Log4j, not every highly exploitable vulnerability can be easily patched. As is the case for the ProxyNotShell vulnerabilities, it’s critically important to develop a response plan for how to defend your environments when no patching protocol exists. 

Regular review of your patching strategy should still be a part of your program, but you should also look more holistically at your organization's methods for cybersecurity and improve your overall security posture. 

The CrowdStrike Falcon platform regularly collects and analyzes trillions of endpoint events every day from millions of sensors deployed across 176 countries. Watch this demo to see the Falcon platform in action.

Learn More

Learn more about how CrowdStrike Falcon® Exposure Management can help you quickly and easily discover and prioritize vulnerabilities and other types of exposures here.

About CVSS Scores

The Common Vulnerability Scoring System (CVSS) is a free and open industry standard that CrowdStrike and many other cybersecurity organizations use to assess and communicate software vulnerabilities’ severity and characteristics. The CVSS Base Score ranges from 0.0 to 10.0, and the National Vulnerability Database (NVD) adds a severity rating for CVSS scores. Learn more about vulnerability scoring in this article. 

Additional Resources

• For more information on which products are in Microsoft’s Extended Security Updates program, refer to the vendor guidance here.
• See how Falcon Exposure Management can help you discover and manage vulnerabilities and other exposures in your environments. 
• Learn how CrowdStrike’s external attack surface module, CrowdStrike® Falcon Surface™, can discover unknown, exposed and vulnerable internet-facing assets, enabling security teams to stop adversaries in their tracks.
• Learn how CrowdStrike's Counter Adversary Operations team provides industry-leading threat intelligence to help strengthen your organization's security and defense strategies.
• Learn how CrowdStrike Falcon® Identity Protection products can stop workforce identity threats faster. 
• Make prioritization painless and efficient. Watch how CrowdStrike Falcon® Spotlight enables IT staff to improve visibility with custom filters and team dashboards. 
• Test CrowdStrike next-gen antivirus for yourself with a free trial of CrowdStrike® Falcon Prevent™.