Microsoft releases April 2024 Patch fixing 150 flaws, two actively exploited, 67 RCE

Microsoft's has released the April 2024 Patch package covering 150 security flaws, which include two actively exploited zero-day vulnerabilities and 67 remote code execution (RCE) vulnerabilities. RCE vulnerabilities are concerning as they allow attackers to run malicious code on a target system from a remote location.

The two zero-day vulnerabilities that were being exploited in malware attacks are:

• CVE-2024-26234 (CVSS score 6.7), is a proxy driver spoofing issue that involves a malicious driver signed with a valid Microsoft Hardware Publisher Certificate. Microsoft has  revoked the certificates of the involved files as part of their Patch Tuesday updates.
• CVE-2024-29988 (CVSS score 8.8), is a bypass of the SmartScreen prompt, a security feature designed to prevent unauthorized software from running. This vulnerability is a bypass for a previously patched flaw, CVE-2024-21412, which in turn was a bypass for another vulnerability, CVE-2023-36025. This chain of vulnerabilities indicates a targeted approach to circumvent Microsoft Defender SmartScreen's protections. The CVE-2024-29988 flaw was exploited by the Water Hydra hacking group in spearphishing attacks that targeted forex trading forums and stock trading Telegram channels.

Among the vulnerabilities patched, three were designated as critical, and pertain to Microsoft Defender for IoT Remote Code Execution Vulnerability: CVE-2024-29053, CVE-2024-21323 and CVE-2024-21322.

More than half of the RCE flaws were adressed in Microsoft SQL drivers, indicating a shared underlying vulnerability across these components. Microsoft also took steps to address 26 Secure Boot bypass vulnerabilities during this update cycle.

Full list of issues fixed in this patch