Accelerate vulnerability response. Find out how at RSAC 2024, May 6-9. Meet With Us →

WATCH DEMO

October 24th CISA KEV Breakdown | CVE-2022-41352

Nucleus Security > CISA KEV > October 24th CISA KEV Breakdown | CVE-2022-41352
CISA KEV Breakdown
  • October 24, 2022
  • Ryan Cribelar
  • CISA KEV

October 24 – 6* New Vulns | CVE-2022-41352, CVE-2021-3493, CVE-2020-3153 and more

In this CISA KEV Breakdown, CISA has added six vulnerabilities to the catalog, *two of them being from October 20, with the rest being added today, October 24. A Linux Kernel vulnerability known as OverlayFS, a zero-day uncovered through an unpatched vulnerability in Zimbra software, four Gigabyte hardware vulnerabilities and lastly two vulnerabilities found in 2020 in Cisco AnyConnect Secure software.

This round of additions highlights the importance of regular security cadence and maintenance. Aside from the zero-day discovered in Zimbra software, the vulnerabilities added in this breakdown have all been fixed in a patch or update.

CVE ID Vendor Software Exploitation Result Due Date EPSS Probability EPSS Percentile GreyNoise Traffic cvssV3
CVE-2022-41352 Zimbra Collaboration (ZCS) Remote Code Execution 11/10/2022 0.14903 95.739 0 9.8
CVE-2021-3493 Linux Kernel Privilege Escalation 11/10/2022 0.08816 93.749 0 7.8
CVE-2018-19320 GIGABYTE Multiple Products Privilege Escalation 11/14/2022 0.01669 75.28 0 7.8
CVE-2018-19321 GIGABYTE Multiple Products Privilege Escalation 11/14/2022 0.01669 75.28 0 7.8
CVE-2018-19322 GIGABYTE Multiple Products Code Execution 11/14/2022 0.0095 30.92 0 7.8
CVE-2018-19323 GIGABYTE Multiple Products Privilege Escalation 11/14/2022 0.15351 95.8 0 9.8
CVE-2020-3153 Cisco AnyConnect Secure Privilege Escalation 11/14/2022 0.01669 75.28 0 6.5
CVE-2020-3433 Cisco AnyConnect Secure Privilege Escalation 11/14/2022 0.02683 81.64 0 7.8

Notable Vulnerability Additions

CVE-2022-41352 | Zimbra Collaboration RCE

First disclosed on the Zimbra forums on September 25, CVE-2022-41352 was deemed a zero-day affecting up to 876 Zimbra servers during a wave of mass exploitation. The vulnerability exists due to the mechanism in which Amavis (Zimbra’s antivirus engine) scans inbound emails and their attachments, with the addition of an outdated cpio package. An official security advisory has been published and linked below, as well as an update from Zimbra with a warning to install the package pax as this is what Amavis uses to extract contents of compressed attachments.

Zimbra points out that this package should be installed as a dependency of Zimbra, however some CentOS installations may be missing the package. Moving forward, this package will now be a requirement for Zimbra installations to allow from Amavis to behave properly when assessing attachments. An update to 9.0.0 P27 will resolve this and several other vulnerabilities

Security Advisory:

https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P27

CVE-2021-3493 | Linux Kernel Privilege Escalation

With Linux malware on an aggressively steady rise over the last couple of years, it should come as no surprise to see CVE-2021-3493, dubbed OverlayFS, find a home in the KEV catalog. A report from AT&T’s security research team suggested OverlayFS was used in Shikitega malware. The vulnerability can be used to obtain root privilege in a low-skill fashion for a high gain in most Ubuntu versions.

Security Advisory:

https://security-tracker.debian.org/tracker/CVE-2021-3493

GIGABYTE Hardware Vulnerabilities | CVE-2018-19320, CVE-2018-19321, CVE-2018-19322, CVE-2018-19323

An observable pattern as of recent in CISA KEV additions is the notable list of consumer-grade devices containing confirmed exploitation. With the lack of context explicitly provided in the KEV, the security community can be left wondering what the additions mean for prioritization translated from public sector requirements to private organizations and what action they take. With the case of these GIGABYTE vulnerabilities, the addition to the KEV could mean anything from nation-state actors pulling off a sophisticated attack against a high-value target’s home network. Or it could simply be that gaming PCs are rampant with hardware for crypto mining capabilities, and are a high-yielding target.

A blog post highlighting the discovery made by SecureAuth’s Diego Jaurez indicates that the vulnerability can actually be exploited by pivoting off of popular EDR products. When these products allow for services to be enabled at an admin level which create for hardware memory flaws to exist, where the EDR product lives and what permissions it has on the system become glaringly important.

Security Advisory:

https://www.gigabyte.com/Support/Security/1801

Cisco AnyConnect Vulnerabilities | CVE-2020-3433, CVE-2020-3153

Disclosed at a chaotic time in early 2020 as organizations transition to WFH at an exceeding rate, research and disclosure surrounding pivotal technologies such as VPN providers became more frequent. CVE-2020-3433 and CVE-2020-3153 were both disclosed as being vulnerable in AnyConnect Secure Mobility Client prior to version 4.8.02042 due to the way in which the installer component, ‘vpndownloader’ is vulnerable to DLL hijacking. While a standard user account is still required to successfully exploit, the implication of a larger attack surface loomed for attackers as organizations began to understood their most vulnerable windows of security in a WFH-enabled environment.

Security Advisory:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj

To get a better understanding of each component of our Breakdown, including what we determine to be a notable release, please see our Frequently Asked Questions section below. Also be sure to follow Nucleus Security on Twitter and LinkedIn where we will be posting each time a new Breakdown is released.

← October 11, 2022 CISA Kev Breakdown

Click here to expand our CISA KEV Breakdown Frequently Asked Questions
  • What makes for a notable addition?
    • A notable addition can arise from many different characteristics. If a particular vulnerability is notable to the security community or a subset of the security community or if the EPSS score reveals notable information about the vulnerability, this can constitute further analysis. It may also be the case that a particular vulnerability shines a light on everyday users and we will highlight important information and key takeaways to ensure users and readers have easy access to actionable information.
  • When is the Breakdown released?
    • We aim to have our analysis of each KEV update posted within 24 hours of the time in which the Catalog is updated. See CISA’s full catalog here
  • I am not bound by BOD 22-01 or federal regulations, why should the KEV concern me?
    • CISA encourages all organizations to utilize the Catalog as an attribute in your vulnerability prioritization framework. Organizations looking to lessen the scope on known dangerous vulnerabilities and make a goal to remediate them can understand where they currently stand against what CISA has confirmed as exploited vulnerabilities in the wild. See CISA’s section on “How should organizations use the KEV catalog?” here.
  • What is EPSS?
    • EPSS is the Exploit Prediction Scoring System. It is an open, data-driven effort for estimating the likelihood (probability) that a software vulnerability will be exploited in the wild. See the EPSS home page on FIRST for more information here.
  • What is the difference between EPSS probability and EPSS percent?
    • EPSS probability is the risk calculated by the model when determining the perceived threat of the vulnerability itself. Percentage is a relative comparison of the rest of the CVEs within the given sample. While the probability only changes upon refreshing the results from the model, the percentage can change purely based on the CVE sample given. In the case of the Breakdown, we use the percentage given by the pool of all CVEs with given EPSS data. Scores may vary post-release of the post given new information about the vulnerabilities and their perceived threat. For more information on applying and understanding EPSS data, see this article on the FIRST website, as well as their FAQ page.
  • What is GreyNoise?
    • GreyNoise is a platform that collects, analyzes, and labels data on IPs that scan the internet and saturate security tools with noise. Through their sensor network, GreyNoise observes vulnerability exploitation attempts for vulnerabilities that are exploited in the wild over the Internet. These are arguably vulnerabilities that should be at the very top of your priority list to remediate.
  • Why are GreyNoise exploitation attempts only observed on ~20% of KEV vulnerabilities?
    • Exploitation of many vulnerabilities in the CISA KEV will not be observed for many reasons that GreyNoise does a good job of explaining in this post. For example:
      • The vulnerability may not be remotely exploitable
      • Vulnerability exploitation may require authentication (and result in privilege escalation)
      • The impacted software may not be exposed to the internet
      • Mass scanning/exploitation is not occurring yet