PT-2022-2935 · Microsoft · Windows

Spencer Mcintyre · Published 2022-06-14 · Updated 2022-06-23 · CVE-2022-32230

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the April, 2022 patch set

Description The issue is related to a null pointer dereference in the implementation of the Windows SMBv3 protocol. By sending a malformed FileNormalizedNameInformation SMBv3 request over a named pipe, an attacker can cause a Blue Screen of Death (BSOD) crash of the Windows kernel, leading to a denial-of-service. For most systems, this attack requires authentication, except in the special case of Windows Domain Controllers, where unauthenticated users can always open named pipes as long as they can establish an SMB session. Typically, after the BSOD, the victim SMBv3 server will reboot.

Recommendations As a temporary workaround, consider restricting access to named pipes to minimize the risk of exploitation. Apply the April, 2022 patch set to resolve the issue. For Windows Domain Controllers, ensure that only authorized users can establish SMB sessions.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2022-03537

CVE-2022-32230

Affected Products

Windows

References · 10

• 🔥 https://github.com/zeroSteiner/metasploit-framework/blob/feat/mod/cve-2022-32230/modules/auxiliary/dos/smb/smb_filenormalizednameinformation.rb · Exploit
• 🔥 https://rapid7.com/blog/post/2022/06/14/cve-2022-32230-windows-smb-denial-of-service-vulnerability-fixed · Exploit
• https://osv.dev/vulnerability/CVE-2022-32230 · Vendor Advisory
• https://support.microsoft.com/en-us/topic/may-10-2022-kb5013942-os-builds-19042-1706-19043-1706-and-19044-1706-60b51119-85be-4a34-9e21-8954f6749504 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-32230 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32230 · Security Note
• https://bdu.fstec.ru/vul/2022-03537 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-32230 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-32230 · Vendor Advisory
• https://t.me/cvenotify/31614 · Telegram Post