February 14, 2023 CISA KEV Breakdown | Microsoft, Apple

February 14 – 4 New Vulns | CVE-2023-23529, CVE-2023-21715, CVE-2023-23376, CVE-2023-21823

In this CISA KEV Breakdown, three zero-day Microsoft vulnerabilities and one zero-day Apple vulnerability all disclosed this year quickly land on the KEV. As Microsoft’s Patch Tuesday rolls around, it is expected that any vulnerabilities indicated by Microsoft to be exploited in the wild would soon be added to the KEV. Unfortunately, there is little detail in Microsoft’s post on evidence to the exploitation of these vulnerabilities. Similar to Microsoft, the advisory posted by Apple related to CVE-2023-23529 shares little evidence to the context of exploitation.

Notable Vulnerability Additions

CVE-2023-23529 | WebKit Remote Code Execution

A type confusion vulnerability exists in Apple iOS, MacOS, Safari and iPadOS WebKit which appears to have the potential to lead to local code execution. An attacker would need to convince a user to visit a malicious application from a vulnerable device to exploit the vulnerability. At time of writing, little evidence currently exists as to how the vulnerability was exploited, and there appears to be no publicly available exploit code.

Security Advisory:

https://support.apple.com/en-us/HT213635, https://support.apple.com/en-us/HT213633, https://support.apple.com/en-us/HT213638

CVE-2023-21715 | Office Macro Bypass

A vulnerability exists in the security feature recently added to Windows in Microsoft 365 Apps for Enterprise to allow for the disabling of macros in Office applications such as excel, allowing a local, authenticated attacker to trick a user into opening an Office document containing a malicious macro. At time of writing it is not clear what the execution of the exploit can allow for the attacker to achieve further. The exploit likely leads to the ability for the attacker to bypass further security features. Exploit code does not appear to be publicly available at this time. The vulnerability was addressed in Microsoft’s February 13, 2023 patch Tuesday.

Security Advisory:

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21715

CVE-2023-23376 | CLFS Local Privilege Escalation

A vulnerability exists in the Common Log File System component of Windows Server 2022 and earlier that could allow for a local, authenticated attacker to escalate privileges to SYSTEM. At time of writing, little evidence exists as to the exploitation observed by Microsoft. There does not appear to be publicly available exploit code at this time. The vulnerability was addressed in Microsoft’s February 13, 2023 patch Tuesday. As Zero Day Initiative’s security update review from this month suggests that this can be considered one of the more severe added to this cycle of patch Tuesday, due to the fact that, like most vulnerabilities which allow escalation to SYSTEM, this vulnerability could theoretically be paired with another code execution vulnerability in a ransomware campaign.

Security Advisory:

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23376

CVE-2023-21823 | Graphics Component Remote Code Execution

A vulnerability exists in Windows Server 2022 and earlier that can allow for a local attacker to execute arbitrary code. At the time of writing, there appears to be little evidence to the exploitation of the vulnerability itself, as well as no public exploit code available. The vulnerability appears to exist due to fact that a user can trigger memory corruption due to a boundary error and execute arbitrary code from within the Graphics Driver Component in Windows.

Security Advisory:

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21823

Be sure to check out Nucleus Security’s KEV Enrichment Dashboard where we overlay vulnerabilities that are added to the catalog with intelligence from GreyNoise, exploit-prediction scoring from EPSS and lastly CVSS. You can use the data yourself and use further metrics to influence decision-making when determining risk of vulnerabilities added to the KEV.

← February 2, 2023 CISA Kev Breakdown