De fix voor CVE-2023-32019 inschakelen met PowerShell

Microsofts Patch Tuesday-updates van juni 2023 bevatten een fix voor een belangrijk Windows Kernel-lek, die standaard is uitgeschakeld. Hier is alles wat u moet weten, inclusief een script om u te helpen de patch in te schakelen voor verschillende Windows-versies.

Wat is CVE-2023-32019?

Microsoft kenmerkt CVE-2023-32019 als een kwetsbaarheid in de Windows Kernel die informatie openbaar maakt en invloed heeft op verschillende Windows-versies, waaronder de nieuwste Windows 10-, Windows Server- en Windows 11-releases. Bij succesvolle uitbuiting kan een aanvaller het heapgeheugen van een geprivilegieerd proces op een server bekijken. vereist geen beheerdersrechten of andere verhoogde rechten om dit te activeren. Het vereist echter wel dat een aanvaller de aanval coördineert met een ander bevoorrecht proces van een andere gebruiker op het systeem. Ondanks een relatief bescheiden CVSS basisscore van 4.7 / 10, heeft Microsoft de kwetsbaarheid als belangrijk bestempeld. Maar de fix die is opgenomen in de updates van juni 2023 vereist een extra stap om het daadwerkelijk in te schakelen. Wat geeft het?

Waarom is de fix voor CVE-2023-32019 standaard uitgeschakeld?

Hoewel de ondersteuningsdocumentatie van Microsoft weinig details bevat, legt het bedrijf uit dat het verhelpen van deze kwetsbaarheid  een “potentiële breukwijziging” introduceert Daarom laten ze het aan gebruikers over om de resolutie handmatig in te schakelen in testomgevingen en moedigen ze hen aan om de storing nauwlettend in de gaten te houden voordat ze de fix op grotere schaal uitrollen. Microsoft zegt ook dat “in een toekomstige release deze resolutie standaard zal worden ingeschakeld. We raden u aan om deze resolutie te valideren in uw omgeving. Schakel de resolutie vervolgens zo snel mogelijk in zodra deze is gevalideerd.”

Hoe de fix voor CVE-2023-32019 inschakelen met PowerShell

Om de kwetsbaarheid te verhelpen, moeten gebruikers een waarde in de registersleutel instellen op basis van de versie van Windows die ze draaien (elke versie vereist een andere sleutelwaarde). Het is voldoende om te zeggen dat deze extra stap heeft geleid tot bezwaren. Om het gemakkelijker te maken, heeft onze Software Product Engineer Kyle Bohlander het volgende script gemaakt dat het besturingssysteem controleert en de juiste registerwijziging toepast.

Opmerking: Dit script is niet beperkt tot NinjaOne-gebruikers. Het kan door iedereen worden gebruikt. Zoals Microsoft adviseert, moet deze fix echter worden uitgerold op testmachines voordat deze breder wordt uitgerold en zoals gebruikelijk is het op eigen risico als je ervoor kiest om het uit te voeren.

Scriptauteur: Kyle Bohlander, Software Product Engineer bij NinjaOne

#Requires -Version 5.1

<#
.SYNOPSIS
    This script will apply the registry fix suggested by microsoft for CVE-2023-32019 for the particular OS the computer is run on. Please note not all OS's have a fix to apply!
    https://support.microsoft.com/en-au/topic/kb5028407-how-to-manage-the-vulnerability-associated-with-cve-2023-32019-bd6ed35f-48b1-41f6-bd19-d2d97270f080
.DESCRIPTION
    This script will apply the registry fix suggested by microsoft for CVE-2023-32019 for the particular OS the computer is run on. Please note not all OS's have a fix to apply!
    https://support.microsoft.com/en-au/topic/kb5028407-how-to-manage-the-vulnerability-associated-with-cve-2023-32019-bd6ed35f-48b1-41f6-bd19-d2d97270f080
.EXAMPLE
    (No Parameters)

    Checking Windows Version....
    Desktop Windows Detected!
    Windows 10 identified!
    22H2 Detected!
    Set Registry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetPoliciesMicrosoftFeatureManagementOverrides4103588492 to 1
    Successfully set registry key!

PARAMETER: -Undo
    Removes the registry key set for this fix. Script will error out if that registry key is not present.
.EXAMPLE
    -Undo
    
    Checking Windows Version....
    Desktop Windows Detected!
    Windows 10 identified!
    22H2 Detected!
    Undoing registry fix...
    Successfully removed registry fix!

.OUTPUTS
    None
.NOTES
    Release: Initial Release (6/15/2023)
    General notes
#>

[CmdletBinding()]
param (
    [Parameter()]
    [switch]$Undo
)

begin {
    # Tests that the script is elevated
    function Test-IsElevated {
        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        $p = New-Object System.Security.Principal.WindowsPrincipal($id)
        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)
    }

    # We want the script to check if its running on a workstation or something else
    function Test-IsWorkstation {
        $OS = Get-CimInstance -ClassName Win32_OperatingSystem
        return $OS.ProductType -eq 1
    }

    # This will set the registry key and any preceding keys needed
    function Set-RegKey {
        param (
            $Path,
            $Name,
            $Value,
            [ValidateSet("DWord", "QWord", "String", "ExpandedString", "Binary", "MultiString", "Unknown")]
            $PropertyType = "DWord"
        )
        if (-not $(Test-Path -Path $Path)) {
            # Check if path does not exist and create the path
            New-Item -Path $Path -Force | Out-Null
        }
        if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)) {
            # Update property and print out what it was changed from and changed to
            $CurrentValue = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore).$Name
            try {
                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null
            }
            catch {
                Write-Error "[Error] Unable to Set registry key for $Name please see below error!"
                Write-Error $_
                exit 1
            }
            Write-Host "$Path$Name changed from $CurrentValue to $($(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore).$Name)"
        }
        else {
            # Create property with value
            try {
                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Stop | Out-Null
            }
            catch {
                Write-Error "[Error] Unable to Set registry key for $Name please see below error!"
                Write-Error $_
                exit 1
            }
            Write-Host "Set $Path$Name to $($(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore).$Name)"
        }
    }

    # Is it Windows 10 or 11 or something else?
    $WindowsVersion = [System.Environment]::OSVersion.Version.Major

    # Current Build Number
    $BuildNumber = [System.Environment]::OSVersion.Version.Build

    # If Script Forms are used grab the input
    if($env:Undo){$Undo = $env:Undo}
}
process {

    # If not elevated error out. Admin priveledges are required to create HKLM registry keys
    if (-not (Test-IsElevated)) {
        Write-Error -Message "Access Denied. Please run with Administrator privileges."
        exit 1
    }

    # Keeping the end user updated on the status
    Write-Host "Checking Windows Version...."
    if (Test-IsWorkstation) {
        Write-Host "Desktop Windows Detected!"
        # Depending on the version we'll want to check on a different set of build numbers
        switch ($WindowsVersion) {
            "10" {
                switch ($BuildNumber) {
                    "22621" {
                        Write-Host "Windows 11 identified!"
                        Write-Host "22H2 Detected!"
                        $key = "Registry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetPoliciesMicrosoftFeatureManagementOverrides"
                        $name = "4237806220"
                        $value = "1"
                    }
                    "22000" {
                        Write-Host "Windows 11 identified!"
                        Write-Host "21H2 Detected!"
                        $key = "Registry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetPoliciesMicrosoftFeatureManagementOverrides"
                        $name = "4204251788"
                        $value = "1"
                    }
                    "19045" {
                        # This sets us up to set the registry key depending on the current build and version.
                        Write-Host "Windows 10 identified!"
                        Write-Host "22H2 Detected!"
                        $key = "Registry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetPoliciesMicrosoftFeatureManagementOverrides"
                        $name = "4103588492"
                        $value = "1"
                    }
                    "19044" {
                        Write-Host "Windows 10 identified!"
                        Write-Host "21H2 Detected!"
                        $key = "Registry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetPoliciesMicrosoftFeatureManagementOverrides"
                        $name = "4103588492"
                        $value = "1"
                    }
                    "19042" {
                        Write-Host "Windows 10 identified!"
                        Write-Host "20H2 Detected!"
                        $key = "Registry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetPoliciesMicrosoftFeatureManagementOverrides"
                        $name = "4103588492"
                        $value = "1"
                    }
                    "17763" {
                        Write-Host "Windows 10 identified!"
                        Write-Host "1809 Detected!"
                        $key = "Registry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession ManagerConfiguration Manager"
                        $name = "LazyRetryOnCommitFailure"
                        $value = "0"
                    }
                    "14393" {
                        Write-Host "Windows 10 identified!"
                        Write-Host "1607 Detected!"
                        $key = "Registry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession ManagerConfiguration Manager"
                        $name = "LazyRetryOnCommitFailure"
                        $value = "0"
                    }
                    default {
                        Write-Warning "Looks like you're either on an unsupported windows build or one not supported by this script? (Only Win 11 22H2 and 21H1 and Win 10 22H2,21H2,21H1,20H2,1809 and 1607 has a fix out!)" 
                        Write-Warning "https://en.wikipedia.org/wiki/Windows_10_version_history"
                        Write-Warning "https://en.wikipedia.org/wiki/Windows_11_version_history"
                        Write-Error "[Error] This version of windows cannot be remediated by this script? Please verify this https://support.microsoft.com/en-au/topic/kb5028407-how-to-manage-the-vulnerability-associated-with-cve-2023-32019-bd6ed35f-48b1-41f6-bd19-d2d97270f080"
                        exit 1
                    }
                }
            }
            default {
                Write-Warning "Looks like you're on a version of windows not supported by this script? (Only Windows 10 and 11 have a fix out!)"
                Write-Error "[Error] This version of windows appears to not be applicable or cannot be remediated by this script? Please verify this https://support.microsoft.com/en-au/topic/kb5028407-how-to-manage-the-vulnerability-associated-with-cve-2023-32019-bd6ed35f-48b1-41f6-bd19-d2d97270f080"
                exit 1
            }
        }
    }
    else {
        Write-Host "Windows Server Detected!"
        if (Get-ComputerInfo | Select-Object OSName | Where-Object { $_.OSName -like "*2022*" }) {
            $key = "Registry::HKEY_LOCAL_MACHINESYSTEMCurrentControlSetPoliciesMicrosoftFeatureManagementOverrides"
            $name = "4137142924"
            $value = "1"
        }
        else {
            Write-Warning "Looks like you're on a version of windows not supported by this script? (Only Server 2022 has a fix out!)"
            Write-Error "[Error] This version of windows appears to not be applicable or cannot be remediated by this script? Please verify this https://support.microsoft.com/en-au/topic/kb5028407-how-to-manage-the-vulnerability-associated-with-cve-2023-32019-bd6ed35f-48b1-41f6-bd19-d2d97270f080"
            exit 1
        }
    }

    if ($key -and -not $Undo) {
        Set-RegKey -Path $key -Name $name -Value $value -PropertyType DWord
        if ((Get-ItemPropertyValue -Path $key -Name $name -ErrorAction Ignore) -ne $value) {
            Write-Error "[Error] Unable to set registry key? Is something blocking the script?"
            exit 1
        }
        else {
            Write-Host "Successfully set registry key!"
            exit 0
        }
    }
    elseif ($Undo) {
        if (Get-ItemProperty -Path $key -ErrorAction Ignore) {
            Write-Host "Undoing registry fix..."
            Remove-ItemProperty -Path $key -Name $name
            if (Get-ItemProperty -Path $key -ErrorAction Ignore) {
                Write-Error "[Error] Unable to undo registry fix!"
                exit 1
            }
            else {
                Write-Host "Successfully removed registry fix!"
                exit 0
            }
        }
        else {
            Write-Error "[Error] Registry Key not found? Did you already undo it?"
            exit 1
        }
    }else{
        Write-Error "[Error] Unable to find registry key to set!"
        exit 1
    }
}
end {
    $ScriptName = "CVE-2023-32019 Remediation"
    $ScriptVariables = @(
        [PSCustomObject]@{
            name           = "Undo"
            calculatedName = "undo"
            required       = $false
            defaultValue   = $false
            valueType      = "CHECKBOX"
            valueList      = $null
            description    = "Whether or not to undo the registry fix."
        }
    )
}