{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2022-35804 SMB Client and Server Remote Code Execution Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35804"
      },
      {
        "category": "self",
        "summary": "CVE-2022-35804 SMB Client and Server Remote Code Execution Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/2022/msrc_cve-2022-35804.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "SMB Client and Server Remote Code Execution Vulnerability",
    "tracking": {
      "current_release_date": "2022-08-09T07:00:00.000Z",
      "generator": {
        "date": "2025-01-02T19:33:43.164Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2022-35804",
      "initial_release_date": "2022-08-09T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2022-08-09T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.22000.856",
            "product": {
              "name": "Windows 11 version 21H2 for x64-based Systems \u003c10.0.22000.856",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.22000.856",
            "product": {
              "name": "Windows 11 version 21H2 for x64-based Systems 10.0.22000.856",
              "product_id": "11926"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 11 version 21H2 for x64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.22000.856",
            "product": {
              "name": "Windows 11 version 21H2 for ARM64-based Systems \u003c10.0.22000.856",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.22000.856",
            "product": {
              "name": "Windows 11 version 21H2 for ARM64-based Systems 10.0.22000.856",
              "product_id": "11927"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 11 version 21H2 for ARM64-based Systems"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-35804",
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target system. This vulnerability can be exploited through two different vectors:",
          "title": "How could an attacker exploit the vulnerability?"
        },
        {
          "category": "faq",
          "text": "Block TCP port 445 at the enterprise perimeter firewall\nTCP port 445 is used to initiate a connection with the affected component. Blocking this port at the network perimeter firewall will help protect systems that are behind that firewall from attempts to exploit this vulnerability. This can help protect networks from attacks that originate outside the enterprise perimeter. Blocking the affected ports at the enterprise perimeter is the best defense to help avoid Internet-based attacks. However, systems could still be vulnerable to attacks from within their enterprise perimeter.\nSecure SMB Traffic in Windows Server: *https://docs.microsoft.com/en-us/windows-server/storage/file-server/smb-secure-traffic\nNo.",
          "title": "What steps can I take to protect my network?"
        }
      ],
      "product_status": {
        "fixed": [
          "11926",
          "11927"
        ],
        "known_affected": [
          "1",
          "2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-35804 SMB Client and Server Remote Code Execution Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35804"
        },
        {
          "category": "self",
          "summary": "CVE-2022-35804 SMB Client and Server Remote Code Execution Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35804"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-08-09T07:00:00.000Z",
          "details": "10.0.22000.856:Security Update:https://support.microsoft.com/help/5016629",
          "product_ids": [
            "2",
            "1"
          ],
          "url": "https://support.microsoft.com/help/5016629"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.7,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Remote Code Execution"
        },
        {
          "category": "exploit_status",
          "details": "Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely"
        }
      ],
      "title": "SMB Client and Server Remote Code Execution Vulnerability"
    }
  ]
}