In the latest Patch Tuesday update for August 2024, Microsoft released a limited set of updates for regular operating systems and Office applications. The highlight of this release was the announcement of six zero-day vulnerabilities, with five affecting the operating systems and one affecting the Office applications. A total of 63 Common Vulnerabilities and Exposures (CVEs) were addressed in Windows 10 and associated servers, while 55 CVEs were fixed in Windows 11.
Despite the relatively straightforward deployment of these updates, Microsoft encountered several issues over the past month. The company acknowledged these issues and assured users that they are actively working on resolving them. It is expected that these issues will be addressed in the upcoming September releases.
One particular exploit that garnered attention this month was the Windows Downdate downgrade attack, which was unveiled at Black Hat USA 2024 by Alon Leviev. This attack utilized CVE-2024-38202 and CVE-2024-21302 to take control of Windows Update and downgrade the operating system to a previous version. This action exposed the system to previously fixed vulnerabilities, effectively making them zero-day vulnerabilities. While Microsoft addressed CVE-2024-21302 in the August updates, mitigation guidance was provided for CVE-2024-38202. Users are advised to stay vigilant and apply any necessary patches to mitigate this risk.
Throughout the month, Microsoft confirmed several reported issues related to the August updates. For example, after installing the August update for Server 2019, users may experience slowdowns, unresponsiveness, and high CPU usage. Microsoft has provided a temporary workaround using the Known Issue Rollback (KIR) policy and is actively working on a permanent fix. Additionally, users who have enabled a dual-boot setup for Windows and Linux may encounter booting issues following the August updates. Microsoft is aware of this issue and is working on a resolution, with expectations that it will be addressed in the September updates.
Looking ahead, Microsoft has announced that the final updates for Windows 11, 21H2 Enterprise and Education versions, as well as Windows 11 22H2 Home and Professional versions, will be released in October. Users are advised to plan for an upgrade to newer versions to ensure continued security updates after October. Furthermore, Microsoft has updated the January patches to prevent installation on systems with insufficient space in the Windows Recovery Environment (WinRE) partition. Users with this issue will need to manually adjust the partition size or use a recommended script before installing the updates.
As we prepare for the September 2024 Patch Tuesday forecast, it is expected that Microsoft will release standard updates for operating systems, Office, Sharepoint, and possibly a .NET framework or SQL update. Adobe recently released a major security update for Acrobat and Reader, so no updates are expected from them this month. Apple and Google are also anticipated to release updates, with Apple due for a security update following their last release in July and Google likely to provide an update for Chrome as usual. Mozilla has already released security updates for Firefox and Thunderbird, with another update for the latter expected soon.
As summer draws to a close and the new school year begins, users can expect continued vigilance in applying updates to ensure the security of their systems. While August brought a relatively calm Patch Tuesday, it is essential to stay proactive in addressing potential vulnerabilities in the upcoming releases.