近日，微软官方发布了多个安全漏洞的公告，包括MicrosoftHyper-V 权限许可和访问控制问题漏洞（CNNVD-202201-787、CVE-2022-21901）、Microsoft Edge 代码注入漏洞（CNNVD-202202-235、CVE-2022-23263）等58个漏洞。成功利用上述漏洞的攻击者可以在目标系统上执行任意代码、获取用户数据，提升权限等。微软多个产品和系统受漏洞影响。目前，微软官方已经发布了漏洞修复补丁，建议用户及时确认是否受到漏洞影响，尽快采取修补措施。
一、 漏洞介绍
2022年2月8日，微软发布了2022年2月份安全更新，共58个漏洞的补丁程序，CNNVD对这些漏洞进行了收录。本次更新主要涵盖了Microsoft Windows 和 Windows 组件、Microsoft Edge、Microsoft Hyper-V、Microsoft Windows PrintSpooler Components、Microsoft Visual Studio、Microsoft OneDrive等。CNNVD对其危害等级进行了评价，其中超危漏洞1个，高危漏洞41个，中危漏洞16个。微软多个产品和系统版本受漏洞影响，具体影响范围可访问https://portal.msrc.microsoft.com/zh-cn/security-guidance查询。
二、漏洞详情
此次更新共包括58个漏洞的补丁程序，其中超危漏洞1个，高危漏洞41个，中危漏洞16个。
序号 | 漏洞名称 | CNNVD编号 | CVE编号 | 危害等级 | 官方链接 |
1 | Microsoft Hyper-V 权限许可和访问控制问题漏洞 | CNNVD-202201-787 | CVE-2022-21901 | 超危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21901 |
2 | Microsoft Edge 代码注入漏洞 | CNNVD-202202-235 | CVE-2022-23263 | 高危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-23263 |
3 | Microsoft Office 代码注入漏洞 | CNNVD-202202-572 | CVE-2022-22004 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22004 |
4 | Microsoft Office 代码注入漏洞 | CNNVD-202202-580 | CVE-2022-22005 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22005 |
5 | Microsoft Office 代码注入漏洞 | CNNVD-202202-582 | CVE-2022-22003 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22003 |
6 | Microsoft Office 代码注入漏洞 | CNNVD-202202-583 | CVE-2022-21988 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21988 |
7 | Microsoft Office 安全漏洞 | CNNVD-202202-586 | CVE-2022-21987 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21987 |
8 | Microsoft Windows Print Spooler Components 权限许可和访问控制问题漏洞 | CNNVD-202202-595 | CVE-2022-22718 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22718 |
9 | Microsoft Windows Print Spooler Components 权限许可和访问控制问题漏洞 | CNNVD-202202-596 | CVE-2022-22717 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22717 |
10 | Microsoft Windows 权限许可和访问控制问题漏洞 | CNNVD-202202-599 | CVE-2022-22715 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22715 |
11 | Microsoft Windows DNS 代码注入漏洞 | CNNVD-202202-607 | CVE-2022-21984 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21984 |
12 | Microsoft Windows Common Log File System Driver 权限许可和访问控制问题漏洞 | CNNVD-202202-609 | CVE-2022-21981 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21981 |
13 | Microsoft Windows Remote Access Connection Manager 权限许可和访问控制问题漏洞 | CNNVD-202202-611 | CVE-2022-22001 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22001 |
14 | Microsoft Windows Common Log File System Driver 权限许可和访问控制问题漏洞 | CNNVD-202202-612 | CVE-2022-22000 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22000 |
15 | Microsoft Windows Kernel 权限许可和访问控制问题漏洞 | CNNVD-202202-614 | CVE-2022-21989 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21989 |
16 | Microsoft Visual Studio 代码注入漏洞 | CNNVD-202202-616 | CVE-2022-21991 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21991 |
17 | Microsoft Windows Mobile Device Management 代码注入漏洞 | CNNVD-202202-617 | CVE-2022-21992 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21992 |
18 | Microsoft Windows Kernel 信息泄露漏洞 | CNNVD-202202-618 | CVE-2022-21993 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21993 |
19 | Microsoft DWM Core Library 权限许可和访问控制问题漏洞 | CNNVD-202202-619 | CVE-2022-21994 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21994 |
20 | Microsoft Windows Print Spooler Components 权限许可和访问控制问题漏洞 | CNNVD-202202-620 | CVE-2022-21999 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999 |
21 | Microsoft Hyper-V 代码注入漏洞 | CNNVD-202202-621 | CVE-2022-21995 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21995 |
22 | Microsoft Windows Print Spooler Components 权限许可和访问控制问题漏洞 | CNNVD-202202-622 | CVE-2022-21997 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21997 |
23 | Microsoft Win32k 权限许可和访问控制问题漏洞 | CNNVD-202202-624 | CVE-2022-21996 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21996 |
24 | Microsoft Windows Runtime 代码注入漏洞 | CNNVD-202202-625 | CVE-2022-21971 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21971 |
25 | Microsoft Dynamics 代码注入漏洞 | CNNVD-202202-627 | CVE-2022-23274 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23274 |
26 | Microsoft Dynamics 权限许可和访问控制问题漏洞 | CNNVD-202202-628 | CVE-2022-23273 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23273 |
27 | Microsoft Dynamics 权限许可和访问控制问题漏洞 | CNNVD-202202-636 | CVE-2022-23272 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23272 |
28 | Microsoft Azure 安全漏洞 | CNNVD-202202-639 | CVE-2022-23256 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23256 |
29 | Microsoft SQL Server 权限许可和访问控制问题漏洞 | CNNVD-202202-668 | CVE-2022-23276 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23276 |
30 | Microsoft Roaming Security Rights Management Services 代码注入漏洞 | CNNVD-202202-676 | CVE-2022-21974 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21974 |
31 | Microsoft Windows Codecs Library 代码注入漏洞 | CNNVD-202202-688 | CVE-2022-21844 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21844 |
32 | Microsoft Windows Codecs Library 代码注入漏洞 | CNNVD-202202-691 | CVE-2022-21926 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21926 |
33 | Microsoft Windows Codecs Library 代码注入漏洞 | CNNVD-202202-694 | CVE-2022-21927 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21927 |
34 | Microsoft Dynamics 代码注入漏洞 | CNNVD-202202-696 | CVE-2022-21957 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21957 |
35 | Microsoft Teams 输入验证错误漏洞 | CNNVD-202202-698 | CVE-2022-21965 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21965 |
36 | Microsoft Windows Codecs Library 代码注入漏洞 | CNNVD-202202-701 | CVE-2022-22709 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22709 |
37 | Microsoft Graphics Components安全漏洞 | CNNVD-202201-785 | CVE-2022-21903 | 高危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21903 |
38 | Microsoft Windows Common Log File System Driver 缓冲区错误漏洞 | CNNVD-202201-789 | CVE-2022-21897 | 高危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21897 |
39 | Microsoft Windows 安全漏洞 | CNNVD-202201-790 | CVE-2022-21896 | 高危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21896 |
40 | Microsoft Windows缓冲区错误漏洞 | CNNVD-202201-791 | CVE-2022-21895 | 高危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21895 |
41 | 多款Microsoft产品安全漏洞 | CNNVD-202201-795 | CVE-2022-21893 | 高危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21893 |
42 | Microsoft Windows DirectX 安全漏洞 | CNNVD-202201-788 | CVE-2022-21898 | 高危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21898 |
43 | Microsoft Edge 代码注入漏洞 | CNNVD-202202-236 | CVE-2022-23262 | 中危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-23262 |
44 | Microsoft Edge 安全漏洞 | CNNVD-202202-237 | CVE-2022-23261 | 中危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-23261 |
45 | Microsoft Office 信息泄露漏洞 | CNNVD-202202-570 | CVE-2022-23252 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23252 |
46 | Microsoft Office 信息泄露漏洞 | CNNVD-202202-573 | CVE-2022-22716 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22716 |
47 | Microsoft Office 安全特征问题特征问题漏洞 | CNNVD-202202-574 | CVE-2022-23280 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23280 |
48 | Microsoft Office 安全特征问题漏洞 | CNNVD-202202-581 | CVE-2022-21968 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21968 |
49 | Microsoft Hyper-V 输入验证错误漏洞 | CNNVD-202202-598 | CVE-2022-22712 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22712 |
50 | Microsoft Windows Common Log File System Driver 输入验证错误漏洞 | CNNVD-202202-604 | CVE-2022-22710 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22710 |
51 | Microsoft Windows 输入验证错误漏洞 | CNNVD-202202-610 | CVE-2022-22002 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22002 |
52 | Microsoft Windows Common Log File System Driver 信息泄露漏洞 | CNNVD-202202-613 | CVE-2022-21998 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21998 |
53 | Microsoft Windows Remote Access Connection Manager 信息泄露漏洞 | CNNVD-202202-615 | CVE-2022-21985 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21985 |
54 | Microsoft Dynamics 权限许可和访问控制问题漏洞 | CNNVD-202202-630 | CVE-2022-23271 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23271 |
55 | Microsoft Dynamics 安全漏洞 | CNNVD-202202-632 | CVE-2022-23269 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23269 |
56 | Microsoft Power BI 权限许可和访问控制问题漏洞 | CNNVD-202202-706 | CVE-2022-23254 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23254 |
57 | Microsoft OneDrive 安全特征问题漏洞 | CNNVD-202202-711 | CVE-2022-23255 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23255 |
58 | Microsoft .NET Core和Microsoft Visual Studio 信息泄露漏洞 | CNNVD-202110-799 | CVE-2021-41355 | 中危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41355 |
三、修复建议
目前，微软官方已经发布补丁修复了上述漏洞，建议用户及时确认漏洞影响，尽快采取修补措施。微软官方补丁下载地址：
https://msrc.microsoft.com/update-guide/en-us
CNNVD将继续跟踪上述漏洞的相关情况，及时发布相关信息。如有需要，可与CNNVD联系。联系方式: cnnvdvul@itsec.gov.cn
声明：本文来自CNNVD安全动态，版权归作者所有。文章内容仅代表作者独立观点，不代表安全内参立场，转载目的在于传递更多信息。如有侵权，请联系 anquanneican@163.com。
