KLA20154 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, obtain sensitive information, execute arbitrary code, bypass security restrictions.

Below is a complete list of vulnerabilities:

1. A denial of service vulnerability in Windows Layer 2 Tunneling Protocol (L2TP) can be exploited remotely to cause denial of service.
2. An elevation of privilege vulnerability in Microsoft Cryptographic Services can be exploited remotely to gain privileges.
3. An information disclosure vulnerability in Windows Overlay Filter can be exploited remotely to obtain sensitive information.
4. A remote code execution vulnerability in Windows Layer 2 Tunneling Protocol (L2TP) can be exploited remotely to execute arbitrary code.
5. An elevation of privilege vulnerability in Windows GDI can be exploited remotely to gain privileges.
6. An information disclosure vulnerability in Windows Cryptographic can be exploited remotely to obtain sensitive information.
7. A remote code execution vulnerability in Windows Lightweight Directory Access Protocol (LDAP) can be exploited remotely to execute arbitrary code.
8. A denial of service vulnerability in Windows Internet Key Exchange (IKE) Extension can be exploited remotely to cause denial of service.
9. A security feature bypass vulnerability in BitLocker can be exploited remotely to bypass security restrictions.
10. A denial of service vulnerability in Windows iSCSI Service can be exploited remotely to cause denial of service.
11. An elevation of privilege vulnerability in Windows Kernel can be exploited remotely to gain privileges.
12. A denial of service vulnerability in Windows Netlogon can be exploited remotely to cause denial of service.
13. An elevation of privilege vulnerability in Windows NTLM can be exploited remotely to gain privileges.
14. A remote code execution vulnerability in Microsoft ODBC Driver can be exploited remotely to execute arbitrary code.
15. A remote code execution vulnerability in Windows Secure Socket Tunneling Protocol (SSTP) can be exploited remotely to execute arbitrary code.
16. An information disclosure vulnerability in Event Tracing for Windows can be exploited remotely to obtain sensitive information.
17. An elevation of privilege vulnerability in Microsoft DWM Core Library can be exploited remotely to gain privileges.
18. An elevation of privilege vulnerability in Windows SMB Witness Service can be exploited remotely to gain privileges.
19. A security feature bypass vulnerability in Windows Boot Manager can be exploited remotely to bypass security restrictions.
20. A denial of service vulnerability in Windows Lightweight Directory Access Protocol (LDAP) can be exploited remotely to cause denial of service.
21. A security feature bypass vulnerability in Windows Smart Card Resource Management Server can be exploited remotely to bypass security restrictions.
22. An elevation of privilege vulnerability in Windows Bluetooth Driver can be exploited remotely to gain privileges.
23. An elevation of privilege vulnerability in Windows Win32k can be exploited remotely to gain privileges.
24. An elevation of privilege vulnerability in Windows Error Reporting Service can be exploited remotely to gain privileges.
25. A remote code execution vulnerability in Microsoft WDAC OLE DB provider for SQL Server can be exploited remotely to execute arbitrary code.
26. An elevation of privilege vulnerability in Windows Local Session Manager (LSM) can be exploited remotely to gain privileges.
27. An elevation of privilege vulnerability in Windows Print Spooler can be exploited remotely to gain privileges.
28. A denial of service vulnerability in Remote Procedure Call Runtime can be exploited remotely to cause denial of service.
29. An elevation of privilege vulnerability in Windows Overlay Filter can be exploited remotely to gain privileges.
30. An elevation of privilege vulnerability in Windows Advanced Local Procedure Call (ALPC) can be exploited remotely to gain privileges.
31. An elevation of privilege vulnerability in Microsoft Message Queuing (MSMQ) can be exploited remotely to gain privileges.
32. An elevation of privilege vulnerability in Windows Backup Service can be exploited remotely to gain privileges.
33. An elevation of privilege vulnerability in Windows Installer can be exploited remotely to gain privileges.
34. An elevation of privilege vulnerability in Windows Bind Filter Driver can be exploited remotely to gain privileges.
35. An information disclosure vulnerability in Windows Kernel can be exploited remotely to obtain sensitive information.
36. An elevation of privilege vulnerability in Windows Credential Manager User Interface can be exploited remotely to gain privileges.
37. An elevation of privilege vulnerability in Windows Task Scheduler can be exploited remotely to gain privileges.
38. A remote code execution vulnerability in Windows Authentication can be exploited remotely to execute arbitrary code.
39. An elevation of privilege vulnerability in Windows Local Security Authority (LSA) can be exploited remotely to gain privileges.
40. An elevation of privilege vulnerability in Windows Ancillary Function Driver for WinSock can be exploited remotely to gain privileges.
41. A denial of service vulnerability in Internet Key Exchange (IKE) Protocol can be exploited remotely to cause denial of service.
42. An information disclosure vulnerability in Windows Point-to-Point Protocol (PPP) can be exploited remotely to obtain sensitive information.

Original advisories

CVE-2023-21757

CVE-2023-21730

CVE-2023-21766

CVE-2023-21555

CVE-2023-21532

CVE-2023-21550

CVE-2023-21676

CVE-2023-21758

CVE-2023-21563

CVE-2023-21527

CVE-2023-21772

CVE-2023-21754

CVE-2023-21728

CVE-2023-21679

CVE-2023-21746

CVE-2023-21749

CVE-2023-21732

CVE-2023-21535

CVE-2023-21536

CVE-2023-21774

CVE-2023-21724

CVE-2023-21556

CVE-2023-21559

CVE-2023-21549

CVE-2023-21552

CVE-2023-21683

CVE-2023-21560

CVE-2023-21557

CVE-2023-21759

CVE-2023-21739

CVE-2023-21753

CVE-2023-21680

CVE-2023-21773

CVE-2023-21558

CVE-2023-21681

CVE-2023-21771

CVE-2023-21546

CVE-2023-21765

CVE-2023-21525

CVE-2023-21767

CVE-2023-21674

CVE-2023-21537

CVE-2023-21675

CVE-2023-21760

CVE-2023-21750

CVE-2023-21551

CVE-2023-21548

CVE-2023-21752

CVE-2023-21542

CVE-2023-21733

CVE-2023-21543

CVE-2023-21776

CVE-2023-21726

CVE-2023-21677

CVE-2023-21541

CVE-2023-21561

CVE-2023-21747

CVE-2023-21748

CVE-2023-21539

CVE-2023-21524

CVE-2023-21678

CVE-2023-21768

CVE-2023-21547

CVE-2023-21755

CVE-2023-21540

CVE-2023-21682

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Windows

Microsoft-Windows-Server

Microsoft-Windows-8

Windows-RT

Microsoft-Windows-10

Microsoft-Windows-Server-2016

Microsoft-Windows-Server-2019

Microsoft-Windows-11

CVE list

CVE-2023-21757 critical

CVE-2023-21730 critical

CVE-2023-21766 warning

CVE-2023-21555 critical

CVE-2023-21532 high

CVE-2023-21550 high

CVE-2023-21676 critical

CVE-2023-21758 critical

CVE-2023-21563 high

CVE-2023-21527 critical

CVE-2023-21772 critical

CVE-2023-21754 critical

CVE-2023-21728 critical

CVE-2023-21679 critical

CVE-2023-21746 critical

CVE-2023-21749 critical

CVE-2023-21732 critical

CVE-2023-21535 critical

CVE-2023-21536 warning

CVE-2023-21774 critical

CVE-2023-21724 critical

CVE-2023-21556 critical

CVE-2023-21559 high

CVE-2023-21549 critical

CVE-2023-21552 critical

CVE-2023-21683 critical

CVE-2023-21560 high

CVE-2023-21557 critical

CVE-2023-21759 warning

CVE-2023-21739 high

CVE-2023-21753 high

CVE-2023-21680 critical

CVE-2023-21773 critical

CVE-2023-21558 critical

CVE-2023-21681 critical

CVE-2023-21771 high

CVE-2023-21546 critical

CVE-2023-21765 critical

CVE-2023-21525 high

CVE-2023-21767 critical

CVE-2023-21674 critical

CVE-2023-21537 critical

CVE-2023-21675 critical

CVE-2023-21760 high

CVE-2023-21750 high

CVE-2023-21551 critical

CVE-2023-21548 critical

CVE-2023-21752 high

CVE-2023-21542 high

CVE-2023-21733 high

CVE-2023-21543 critical

CVE-2023-21776 high

CVE-2023-21726 critical

CVE-2023-21677 critical

CVE-2023-21541 critical

CVE-2023-21561 critical

CVE-2023-21747 critical

CVE-2023-21748 critical

CVE-2023-21539 critical

CVE-2023-21524 critical

CVE-2023-21678 critical

CVE-2023-21768 critical

CVE-2023-21547 critical

CVE-2023-21755 critical

CVE-2023-21540 high

CVE-2023-21682 high

KB list

5022287

5022291

5022286

5022297

5022352

5022303

5022346

5022289

5022282

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Windows 8.1 for x64-based systemsWindows Server 2022 (Server Core installation)Windows 10 Version 21H2 for x64-based SystemsWindows 10 for x64-based SystemsWindows 10 Version 1607 for x64-based SystemsWindows 11 version 21H2 for ARM64-based SystemsWindows 10 Version 20H2 for 32-bit SystemsWindows 10 Version 20H2 for ARM64-based SystemsWindows 10 Version 21H2 for ARM64-based SystemsWindows 10 for 32-bit SystemsWindows 10 Version 1607 for 32-bit SystemsWindows 10 Version 22H2 for 32-bit SystemsWindows 10 Version 1809 for ARM64-based SystemsWindows 8.1 for 32-bit systemsWindows Server 2016 (Server Core installation)Windows 11 Version 22H2 for x64-based SystemsWindows RT 8.1Windows Server 2019Windows 10 Version 22H2 for x64-based SystemsWindows 11 version 21H2 for x64-based SystemsWindows 10 Version 1809 for 32-bit SystemsWindows 10 Version 22H2 for ARM64-based SystemsWindows 10 Version 1809 for x64-based SystemsWindows Server 2016Windows 10 Version 21H2 for 32-bit SystemsWindows Server 2022Windows Server 2019 (Server Core installation)Windows 11 Version 22H2 for ARM64-based Systems