CVE-2022-26809: Remote Procedure Call Runtime Remote Code Execution Vulnerability

Overview

Severity
Critical (CVSS 9.8)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Remote Code Execution
Exploit Status
Not Exploited
Exploitation Likelihood
More Likely
Patch Tuesday
2022-Apr
Released
2022-04-12
Last Updated
2022-04-19
EPSS Score
92.56% (percentile: 99.7%)

FAQ

How could an attacker exploit this vulnerability? To exploit this vulnerability, an unauthenticated attacker would need to send a specially crafted RPC call to an RPC host. This could result in remote code execution on the server side with the same permissions as the RPC service. Why did Microsoft remove the Mitigation to “Block TCP port 445 at the enterprise perimeter firewall”? The researcher who submitted the vulnerability used SMB as the attack vector to trigger the exploit in the RPC service, so the mitigation was effective for the issue that was presented to us. Although blocking ports 139 and 445 [SMB] at the perimeter firewall is a recommended practice, it does not directly protect against all potential attack scenarios for this specific vulnerability. At this time we are not aware of any other specific attack vectors for this vulnerability, and continue to encourage users to: Apply the April 2022 security updates to fully address this issue. Follow Microsoft guidelines to secure SMB traffic. See Secure SMB Traffic in Windows Server. The vulnerability is in RPC, not SMB. Should I also block RPC? The known attack that was presented to Microsoft does not use TCP Port 135 to initiate an exploit but, as the vulnerability is in RPC, blocking TCP port 135 at the enterprise perimeter firewall is a recommended best practice that would reduce the likelihood of other potential attacks against this vulnerability.

Known Exploits (1)

  • Remote Procedure Call Runtime Remote Code Execution — added 2022-06-13T11:08:33Z

Detection & Weaponization (2 sources)

Maturity: Detection

  • Sigma rules: Potential CVE-2022-26809 Exploitation Attempt
  • GitHub PoC: 10 repositories

Affected Products (42)

Windows

  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows Server 2022
  • Windows Server 2022 (Server Core installation)
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows Server, version 20H2 (Server Core Installation)
  • Windows 11 version 21H2 for x64-based Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)
  • Windows 8.1 for 32-bit systems
  • Windows 8.1 for x64-based systems
  • Windows RT 8.1

ESU

  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)

Security Updates (15)

Acknowledgments

BugHunter010 (@CyberKunlun)

Revision History

  • 2022-04-12: Information published.
  • 2022-04-19: Removed the Mitigation “Block TCP port 445 at the enterprise perimeter firewall” and added an FAQ to explain that the mitigation does not directly protect against all potential attack scenarios for this specific vulnerability. Added information in FAQs to provide recommended best practices for port blocking at the perimeter firewall. These are informational changes only.