April’s Patch Tuesday includes 150 vulnerabilities, 60 which could lead to remote code execution

In one of the largest Patch Tuesdays in years, Microsoft disclosed 150 vulnerabilities across its software and product portfolio this week, including more than 60 that could lead to remote code execution.

Though April's monthly security update from Microsoft is the largest since at least the start of 2023, only three of the issues disclosed are considered "critical," all of which are remote code execution vulnerabilities in Microsoft Defender for IoT.

Most of the remainder of the security issues are considered "important," and only two are "moderate" severity.

The three critical vulnerabilities – CVE-2024-21322, CVE-2024-21323 and CVE-2024-29053 – are all remote code execution vulnerabilities in Microsoft Defender for IoT. Though little information is provided on how these issues could be exploited, Microsoft did state that exploitation of these vulnerabilities is "less likely."

There are also three vulnerabilities Talos would like to highlight, as Microsoft as deemed them "more likely" to be exploited:

• CVE-2024-26241: Elevation of privilege vulnerability in Win32k
• CVE-2024-28903: Security feature bypass vulnerability in Windows Secure Boot
• CVE-2024-28921: Security feature bypass vulnerability in Windows Secure Boot

More than half of the code execution vulnerabilities exist in Microsoft SQL drivers. An attacker could exploit these vulnerabilities by tricking an authenticated user into connecting to an attacker-created SQL server via ODBC, which could result in the client receiving a malicious network packet. This could allow the adversary to execute code remotely on the client.

A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.

In response to these vulnerability disclosures, Talos is releasing a new Snort rule set that detects attempts to exploit some of them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Cisco Security Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

The rules included in this release that protect against the exploitation of many of these vulnerabilities are 63254 - 63257, 63265 - 63271, 63274 and 63275. There are also Snort 3 rules 300873, 300874 and 300877 - 300879.