Full Report
The Patch Tuesday for December of 2024 includes 72 vulnerabilities, including four that Microsoft marked as “critical.” The remaining vulnerabilities listed are classified as “important.”
Analysis Summary
# Vulnerability: December 2024 Microsoft Patch Summary (Focus on Critical/Exploited Flaws)
## CVE Details
This summary focuses on several key vulnerabilities disclosed during the December 2024 Patch Tuesday, including those rated critical or actively exploited.
| CVE ID | CVSS Score | Severity | CWE | Exploitation Status |
| :--- | :--- | :--- | :--- | :--- |
| CVE-2024-49112 | 9.8 | Critical | N/A | Less likely |
| CVE-2024-49124 | N/A | Critical | N/A | Less likely (Race Condition) |
| CVE-2024-49127 | N/A | Critical | N/A | Less likely (Race Condition) |
| CVE-2024-49126 | N/A | Critical | N/A | Less likely (Race Condition) |
| CVE-2024-49105 | N/A | Critical | N/A | Less likely (Not detected in the wild) |
| CVE-2024-49117 | N/A | Critical | N/A | Less likely (Not detected in the wild) |
| CVE-2024-49106, -49108, -49115, -49119, -49120, -49123, -49132, -49116, -49128 | N/A | Critical | Use-After-Free (Implied by UAF scenario) | High Complexity, Less likely (Not detected in the wild) |
| CVE-2024-49122, -49118 | N/A | Critical | N/A | High Complexity, Less likely (Not detected in the wild) |
| CVE-2024-49138 | 7.8 | Important | N/A | **Actively exploited in the wild** (EoP) |
| CVE-2024-49070 | N/A | Important | N/A | **More likely to be exploited** |
| CVE-2024-49093 | N/A | Important | N/A | **More likely to be exploited** |
| CVE-2024-49088, -49090 | N/A | Important | N/A | **More likely to be exploited** |
| CVE-2024-49114 | N/A | Important | N/A | **More likely to be exploited** |
## Affected Systems
- **Products:** Microsoft Windows (various components: LDAP service, LSASS, Remote Desktop Client/Gateway, Hyper-V, MSMQ, Common Log File System Driver, ReFS, Cloud Files Mini Filter Driver, SharePoint).
- **Versions:** Unspecified in the provided context; requires consulting vendor advisories for specific affected OS/Software versions covered by the December 2024 updates.
- **Configurations:** Varies significantly based on the CVE (e.g., systems running the LDAP service, systems with RD Gateway role, Guest VMs interacting with host hardware via Hyper-V, MSMQ servers).
## Vulnerability Description
The set of vulnerabilities includes several critical Remote Code Execution (RCE) flaws:
1. **Windows LDAP RCE (CVE-2024-49112, -49124, -49127):** Exploitation can lead to arbitrary code execution in the context of the LDAP service. Some require sending a specially crafted request and winning a race condition.
2. **LSASS RCE (CVE-2024-49126):** Allows a low-privilege attacker to target server accounts via a network call and execute code, contingent on winning a race condition.
3. **RDC/MMC RCE (CVE-2024-49105):** Allows an authenticated attacker to trigger RCE via a remote desktop connection using MMC.
4. **Hyper-V RCE (CVE-2024-49117):** Requires an authenticated attacker locally on a guest VM to send crafted file operation requests, leading to RCE on the host server.
5. **RD Gateway RCE (Multiple CVEs):** Exploitation involves connecting to a system with the RD Gateway role, triggering a race condition to cause a Use-After-Free (UAF) scenario, leading to code execution.
6. **MSMQ RCE (CVE-2024-49122, -49118):** Requires sending a crafted MSMQ packet and winning a race condition against the queue manager service.
7. **Active Exploitation (CVE-2024-49138):** An Elevation of Privilege (EoP) vulnerability in the Windows Common Log File System Driver that has been observed in active exploitation.
8. **"More Likely" Exploited (Important Rating):** Several EoP flaws (CVE-2024-49093, -49088, -49090, -49114) and an RCE in SharePoint (CVE-2024-49070) are flagged by Cisco Talos as being more likely targets for exploitation, despite lower severity ratings from Microsoft.
## Exploitation
- **Status (Criticals):** Mostly "Less likely," with one active exploit reported (CVE-2024-49138). Several RCEs require winning complex "race conditions."
- **Complexity (Criticals):** Varies. Some are low/medium preconditions, while the RD Gateway and MSMQ flaws specify **High** complexity due to race conditions.
- **Attack Vector (General):** Predominantly Network/Remote (for RCEs), though CVE-2024-49138 (EoP) and CVE-2024-49117 (Hyper-V) imply Local or Guest-to-Host access requirements.
## Impact
Attack scenarios primarily lead to **Remote Code Execution (RCE)**, resulting in:
- **Confidentiality:** High (Code execution allows data reading/exfiltration).
- **Integrity:** High (Arbitrary code execution grants system modification).
- **Availability:** High (System crashing or resource takeover).
*Note: CVE-2024-49138 is explicitly an Elevation of Privilege.*
## Remediation
### Patches
Patching is required for all disclosed vulnerabilities via the December 2024 security updates released by Microsoft. Users must apply the relevant security updates corresponding to their affected Windows versions.
### Workarounds
No specific workarounds for the critical RCEs are provided in the summary, although many require complex conditions (race conditions, authentication) that might offer temporary risk reduction if those conditions are absent or mitigated by specific local network controls. For RD Gateway RCEs, temporarily disabling or restricting access to the exposed service might reduce immediate external risk until patching.
## Detection
Cisco Talos has released new Snort rules to aid in detection:
- **Snort (Classic):** Rules 64308, 64309, 64310, 64311, 64313, 64314, 63874, 63875, 64312, 64306, 64307.
- **Snort 3:** Rules 301085, 301086, 301087, 300987, 64312, 301084.
- **Mitigation Strategy:** Cisco Security Firewall customers should update their SRU. Snort open-source customers should download the latest rule pack.
## References
- Vendor Advisories: Microsoft MSRC (Refer to the December 10, 2024 update guide).
- Relevant Links:
- General Update Guide: msrc.microsoft.com/update-guide/
- CVE-2024-49112: msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49112
- CVE-2024-49105: msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49105
- Snort Rule Downloads: snort.org/