QID 91921

Date Published: 2022-07-13

QID 91921: Microsoft Windows Network File System (NFS) Remote Code Execution (RCE) Vulnerability for July 2022

Microsoft Windows Network File System is vulnerable to Remote Code Execution Vulnerability.

This vulnerability is not exploitable in NFSV4.1

The KB Articles associated with the update are:
KB5015874
KB5015877
KB5015863
KB5015875
KB5015861
KB5015862
KB5015866
KB5015870
KB5015808
KB5015807
KB5015827
KB5015811

QID Detection Logic (Authenticated):

This QID checks for the file version of nfssvr.sys and checks if the mitigations have been applied.

This vulnerability could be exploited over the network by making an unauthenticated, specially crafted call to a Network File System (NFS) service to trigger a Remote Code Execution (RCE).

  • CVSS V3 rated as Critical - 8.1 severity.
  • CVSS V2 rated as High - 6.8 severity.
    • Solution
    Please refer to the CVE-2022-22029 for more information pertaining to the vulnerability.

    Workaround:
    The following PowerShell command will disable the affected versions:
    PS C:\Set-NfsServerConfiguration -EnableNFSV3 $false

    Vendor References

    CVEs related to QID 91921

    CVE-2022-22029 |
    Software Advisories
    Advisory ID Software Component Link
    KB5015807 URL Logo support.microsoft.com/en-in/help/5015807
    KB5015808 URL Logo support.microsoft.com/en-in/help/5015808
    KB5015811 URL Logo support.microsoft.com/en-in/help/5015811
    KB5015827 URL Logo support.microsoft.com/en-in/help/5015827
    KB5015861 URL Logo support.microsoft.com/en-in/help/5015861
    KB5015862 URL Logo support.microsoft.com/en-in/help/5015862
    KB5015863 URL Logo support.microsoft.com/en-in/help/5015863
    KB5015866 URL Logo support.microsoft.com/en-in/help/5015866
    KB5015870 URL Logo support.microsoft.com/en-in/help/5015870
    KB5015874 URL Logo support.microsoft.com/en-in/help/5015874
    KB5015875 URL Logo support.microsoft.com/en-in/help/5015875
    KB5015877 URL Logo support.microsoft.com/en-in/help/5015877
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].