March 2024 Patch Tuesday Updates Fix Critical Hyper-V Vulnerabilities

Key Takeaways:

• Microsoft’s March 2024 Patch Tuesday updates for Windows 11 and Windows 10 addressed two critical Hyper-V vulnerabilities.
• Microsoft has also fixed a remote code execution vulnerability in Microsoft Exchange.
• Microsoft introduced quality and experience updates, such as support for USB 80Gbps and improved cellular to Wi-Fi switching reliability.

Microsoft released yesterday the March 2024 Patch Tuesday updates for Windows 11 and Windows 10 devices. The latest update includes fixes for two critical vulnerabilities in the Windows Hyper-V virtualization technology.

This month’s Patch Tuesday updates address 60 security flaws in Windows and other components. There are 18 remote code execution (RCE) vulnerabilities and several privilege escalation flaws that target Windows PCs.

60 vulnerabilities fixed in the March 2024 Patch Tuesday updates

The most critical vulnerabilities fixed in the March 2024 Patch Tuesday updates are listed below:

• CVE-2024-21407: The remote-code execution vulnerability could allow hackers to execute arbitrary code on the compromised virtual machines hosted on the Hyper-V server. A successful attack could compromise the availability, integrity, and confidentiality of the system.
• CVE-2024-21408: The denial-of-service vulnerability could let hackers crash the Hyper-V service. Microsoft did not provide additional details about the nature of the flaw, but exploitation only requires basic privileges to disrupt the system.
• CVE-2024-21390: This is an elevation of privilege flaw in the Microsoft Authenticator app with a CVSS score of 7.1. It could enable hackers to gain unauthorized access to multi-factor authentication (MFA) codes. The threat actors could also steal data from sensitive accounts and redirect users to phishing websites.
• CVE-2024-26198: This remote code execution vulnerability in Microsoft Exchange is rated important with an 8.8 CVSS rating. The attacker could exploit the flaw by placing a malicious file in an online directory and tricking users to open it.

You can find the full list of CVEs included in this month’s Patch Tuesday below:

Quality and experience updates

Microsoft released the KB5035853 update for Windows 11 versions 23H2 and 22H2. This release allows users to edit photos taken from their Android phones using the Snipping tool. It should make it easier for users to share the photos with their friends and colleagues. This month’s update also brings support for USB 80Gbps to Windows 11 devices.

Moreover, the latest update improves the reliability of cellular to Wi-Fi switching for Windows 11 machines. Microsoft has also fixed a bug that was previously preventing Windows devices connected to external devices from going to sleep mode.

For Windows 10 users, Microsoft has updated the Windows Share window with new sharing options for Gmail, WhatsApp, LinkedIn, and Facebook. There are also reliability enhancements for secondary drive storage for games.

Windows Update testing and best practices

Microsoft advises organizations to conduct comprehensive testing prior to deploying monthly patches in production environments. This is crucial as it helps to ensure that the updates do not cause any unexpected issues or disruptions to the systems. However, IT administrators should not delay deployment to the extent that it exposes the organization to increased risk.

A recommended best practice is to back up systems before applying updates to minimize unexpected post-update issues. This approach helps enterprise customers to ensure minimal downtime and disruption to critical operations.

There are backup tools built into Windows and Windows Server that you can use to restore systems in the event a patch causes a problem. The backup features in Windows can be used to restore an entire system, or files and folders on a granular basis.