Microsoft SMBv3 Remote Code Execution Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-02-10
• Known to be used in ransomware campaigns
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 10.0

[ Description ]Official description

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

CISA: A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 10 Aug 2022): Apply updates per vendor instructions.

• Patch on portal.msrc.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1…Third Party AdvisoryVDB Entry
• packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.…ExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Esc…Third Party AdvisoryVDB Entry
• packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.htmlExploitThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.htmlThird Party AdvisoryVDB Entry
• packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Ex…Third Party AdvisoryVDB Entry
• portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796PatchVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource