Full Report
Today is Microsoft's February 2025 Patch Tuesday, which includes security updates for 55 flaws, including four zero-day vulnerabilities, with two actively exploited in attacks. [...]
Analysis Summary
This is a summary of the Microsoft February 2025 Patch Tuesday, focusing on the critical and zero-day vulnerabilities identified.
# Vulnerability: Microsoft February 2025 Patch Tuesday Summary (Focus on Zero-Days)
## CVE Details
* **CVE ID:** Multiple (Focus on Zero-Days: CVE-2025-21391, CVE-2025-21418, CVE-2025-21194, CVE-2025-21377)
* **CVSS Score:** Not explicitly listed for all CVEs, but the report mentions **three "Critical"** vulnerabilities (all RCEs) and four zero-days.
* **CWE:** Various (e.g., Elevation of Privilege, Security Feature Bypass, Spoofing).
## Affected Systems
* **Products:** Windows (Various components including Storage, Ancillary Function Driver for WinSock, Microsoft Surface, Windows Telephony Services, etc.), Microsoft Dynamics 365 Sales (one separate EoP flaw was noted).
* **Versions:** Not explicitly listed in the text provided, but patches are released for multiple Windows versions (including Windows 11 and Windows 10 updates mentioned for non-security fixes).
* **Configurations:** Specific configurations noted for CVE-2025-21194 (related to specific hardware supporting UEFI/Hypervisors in a VM host environment).
## Vulnerability Description
Microsoft released updates addressing 55 flaws, including 19 EoP, 22 RCE, 2 Security Feature Bypass, 1 Information Disclosure, 9 DoS, and 3 Spoofing vulnerabilities.
**Key Zero-Day Vulnerabilities:**
1. **CVE-2025-21391 (Windows Storage EoP):** Allows an attacker to delete targeted files, potentially leading to a Denial of Service by deleting critical service data.
2. **CVE-2025-21418 (Windows Ancillary Function Driver for WinSock EoP):** Allows threat actors to escalate privileges to SYSTEM level on Windows.
3. **CVE-2025-21194 (Microsoft Surface Security Feature Bypass):** A Hypervisor vulnerability potentially allowing adversaries to bypass UEFI and compromise the secure kernel on specific hardware. This is potentially linked to previously disclosed PixieFail flaws.
4. **CVE-2025-21377 (NTLM Hash Disclosure Spoofing):** Occurs when a user interacts minimally (single-click, right-click) with a malicious file, potentially triggering an unintended remote connection to a malicious share. This exposes the user's NTLM hash, leading to potential credential theft or pass-the-hash attacks.
## Exploitation
* **Status:** Two vulnerabilities (CVE-2025-21391 and CVE-2025-21418) are **actively exploited in the wild**. Two others (CVE-2025-21194 and CVE-2025-21377) are **publicly disclosed**.
* **Complexity:** Not explicitly rated, but the NTLM hash disclosure (CVE-2025-21377) requires "minimal interaction" post-disclosure.
* **Attack Vector:** Varies. CVE-2025-21377 implies Network/Local interaction, while CVE-2025-21418 suggests Local/Network access to gain SYSTEM privileges.
## Impact
* **Confidentiality:** Affected by CVE-2025-21377 (NTLM hash theft). Others, like CVE-2025-21391, explicitly state no disclosure of confidential information.
* **Integrity:** Significantly impacted by RCEs and the EoP exploits (CVE-2025-21391 allows file deletion).
* **Availability:** Potentially impacted by CVE-2025-21391 (file deletion leading to service unavailability) and the general impact of successfully executed RCEs.
## Remediation
### Patches
* Official security updates for all 55 flaws, including the four zero-days listed, are available as part of the February 2025 Patch Tuesday release. (Specific KB numbers for the zero-day fixes are not provided in the summary text but are available via the MSRC advisories referenced by the CVE IDs).
### Workarounds
* No specific vendor-provided workarounds for the zero-day vulnerabilities were detailed in this summary text, other than the availability of the patches themselves.
## Detection
* **Indicators of Compromise:** Detection methods would be specific to the exploit chain: monitoring file deletion activity via the Storage subsystem (CVE-2025-21391) or observing unexpected network connections/NTLM authentication attempts to external servers when interacting with file shares or objects that should not trigger authentication (CVE-2025-21377).
* **Detection Methods and Tools:** Standard endpoint detection and response (EDR) solutions should be leveraged to monitor for IOCs related to the specific exploit techniques associated with actively exploited vulnerabilities.
## References
* Vendor advisories available via Microsoft MSRC using the linked CVEs (e.g., msrcc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21391).
* Related information on PixieFail flaws (likely relevant to CVE-2025-21194): hxxps://www.bleepingcomputer.com/news/security/pixiefail-flaws-impact-pxe-network-boot-in-enterprise-systems/