{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "James Sharpe with \u003ca href=\"https://www.zenotech.com/\"\u003eZenotech Ltd\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2022-33637 Microsoft Defender for Endpoint Tampering Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33637"
      },
      {
        "category": "self",
        "summary": "CVE-2022-33637 Microsoft Defender for Endpoint Tampering Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2022/msrc_cve-2022-33637.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Microsoft Defender for Endpoint Tampering Vulnerability",
    "tracking": {
      "current_release_date": "2025-07-08T07:00:00.000Z",
      "generator": {
        "date": "2025-07-08T15:35:54.239Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2022-33637",
      "initial_release_date": "2022-07-12T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2022-07-12T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2022-07-25T07:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added FAQ information. This is an informational change only."
        },
        {
          "date": "2025-07-08T07:00:00.000Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Updated links to security updates.  This is an informational change only."
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c101.68.80",
            "product": {
              "name": "Microsoft Defender for Endpoint for Linux \u003c101.68.80",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "101.68.80",
            "product": {
              "name": "Microsoft Defender for Endpoint for Linux 101.68.80",
              "product_id": "12015"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Defender for Endpoint for Linux"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-33637",
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "This is a client-side code vulnerability consisting of the usage of uninitialized buffer in the buffer pool by the MDE sensor on Linux systems.  This affects the IP field, causing any remote connection, including failed connections, to be considered as \u2018Successful remote logon\u2019.  This, in turn, triggers a false-positive alert.\nAll Linux machines are affected. The impact is more severe on servers which are under heavy network/login load.\nThe fix enforced full initialization for each buffer before use.\nThe fix is included in defender version 101.68.80. Customers are advised to ensure their Defender client is the latest version.",
          "title": "What is the nature of this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "12015"
        ],
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-33637 Microsoft Defender for Endpoint Tampering Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33637"
        },
        {
          "category": "self",
          "summary": "CVE-2022-33637 Microsoft Defender for Endpoint Tampering Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2022/msrc_cve-2022-33637.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-07-12T07:00:00.000Z",
          "details": "101.68.80:Security Update:https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-updates?view=o365-worldwide",
          "product_ids": [
            "1"
          ],
          "url": "https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-updates?view=o365-worldwide"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5.7,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Tampering"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Microsoft Defender for Endpoint Tampering Vulnerability"
    }
  ]
}