Patch management is far easier said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.
Below, IT Pro has collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.
Google fixes four Android bugs under attack
Google has addressed four vulnerabilities as part of its latest security update for Android that may be under limited, targeted exploitation. These can be abused to give hackers full control over Android devices.
These four vulnerabilities - CVE-2021-1905, CVE-2021-1906, CVE-2021-28663, and CVE-2021-28664 - are embedded in the Qualcomm Graphics and Arm Mali GPU Driver components. These have been patched alongside a swathe of other flaws.
The first two affect the Qualcomm Graphics module. CVE-2021-1905 is described as a use-after-free flaw due to improper handling of memory mapping of multiple processes, and is rated 8.4 on the CVSS threat severity scale. The second, CVE-2021-1906, concerns inadequate handling of address deregistration, which can lead to a new GPU address allocation failure, according to Qualcomm.
The latter two are embedded in the Arm Mali GPU Driver component. CVE-2021-28663 can be exploited to allow an unprivileged user to launch information disclosure attacks or gain root privileges. The final flaw, CVE-2021-28664, similarly allows attackers to achieve read/write access to read-only memory, allowing privilege escalation or denial of service (DoS) attacks due to memory corruption.
Proof-of-concept exploit for wormable Windows 10 flaw unveiled
Security researcher Axel Souchet released a proof-of-concept exploit for a dangerous Windows 10 and Windows Server vulnerability that many fear can spread autonomously if exploited by hackers.
The vulnerability, tracked as CVE-2021-31166, is embedded in the HTTP Protocol Stack used by the Windows Internet Information Services (IIS) web server. It requires attackers to send malicious packets to targeted servers using the vulnerable HTTP Protocol Stack. Microsoft has also warned that the bug can allow unauthenticated attackers to execute arbitrary code remotely, in most cases.
Microsoft patched the flaw during this month’s Patch Tuesday round of updates, and has encouraged users to update their systems as soon as possible. Souchet's exploit this can trigger a denial of service (DoS) attack, leading to the blue screen of death (BSoD) on affected devices.
AMD discloses flaws in CPU encryption technology
AMD has acknowledged two vulnerabilities uncovered by security researchers affecting the first, second, and third generations of AMD EPYC, as well as EPYC embedded CPUs.
Both flaws, CVE-2020-12967 and CVE-2021-26311, are found in the Secure Encrypted Virtualisation (SEV) component of AMD processors. This is a security feature that uses a unique key to encrypt memory contents that are running on a virtual machine (VM) and managed by a hypervisor.
RELATED RESOURCE
Leveraging knowledge management to scale business
Get the right knowledge to the right person at the right time
The first flaw could potentially lead to remote code execution in the guest virtual CPU. The second flaw, meanwhile, could allow memory to be rearranged in the guest address space and remain undetected, which could be used by a malicious hypervisor to conduct remote code execution within the guest. In both cases, a malicious administrator must have the appropriate privileges to compromise the server hypervisor.
Both flaws have been detailed in research papers that are set to be presented at this year’s IEEE Workshop on Offensive Technologies (WOOT’21). AMD has provided mitigation for the vulnerabilities, but these measures are only compatible with third-generation CPUs.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
-
A critical Ivanti flaw is being exploited in the wild – here’s what you need to knowNews Cyber criminals are actively exploiting a critical RCE flaw affecting Ivanti Connect Secure appliances
-
Researchers claim an AMD security flaw could let hackers access encrypted dataNews Using only a $10 test rig, researchers were able to pull off the badRAM attack
-
A journey to cyber resiliencewhitepaper DORA: Ushering in a new era of cyber security
