Microsoft Windows Support Diagnostic Tool (MSDT) CVE-2022-30190 (remote code execution when MSDT is called through its URL protocol from an app such as Word, exploited, CISA KEV): which Windows updates fix it, and what's the temporary workaround if I can't patch yet?

What it is: CVE-2022-30190 is a remote code execution flaw in the Microsoft Support Diagnostic Tool (MSDT). When MSDT is launched through its URL protocol by a calling application such as Word, an attacker can run code with that application's privileges and then install programs, read or change data, or create accounts within the user's rights. Microsoft published it on May 30, 2022 and marked it as publicly disclosed and exploited. The attack needs the user to open a malicious file (CVSS 7.8, attack vector local, user interaction required). CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-14. Am I affected: - Windows machines that haven't received the June 2022 (or later) cumulative Windows updates. - Microsoft later found and fixed a defense-in-depth variant in the July 2022 cumulative updates, so anything older than July 2022 is behind. For Windows 8.1 / Server 2012 R2, Server 2012, Windows 7 / Server 2008 R2 and Server 2008 SP2, Microsoft points to KB5015805; on Windows 10 and newer the fix is part of the cumulative updates. Fix: 1. Install current cumulative Windows updates (June 2022 at minimum, July 2022 or later for the variant fix). Microsoft says machines on automatic updates need no further action. 2. Temporary workaround, only until patched: disable the MSDT URL protocol. From an administrator Command Prompt, back up the key with reg export HKEY_CLASSES_ROOT\ms-msdt <backup-file>, then remove it with reg delete HKEY_CLASSES_ROOT\ms-msdt /f. Troubleshooters then no longer open from links but still work from the Get Help app and system settings. To undo, run reg import <backup-file> as administrator. 3. Don't rely on the Group Policy setting 'Turn on MSDT interactive communication with support provider' (DisableQueryRemoteServer): Microsoft says it gives no protection against this flaw. 4. Keep Office's defaults: Microsoft notes that Protected View and Application Guard for Office, which open internet documents by default, prevent the attack. 5. Microsoft Defender users: keep detection builds at 1.367.851.0 or later and turn on cloud-delivered protection and automatic sample submission. In Defender for Endpoint, review alerts titled 'Suspicious behavior by an Office application' and 'Suspicious behavior by Msdt.exe'. If a machine may have been hit, treat it as compromised: investigate, rebuild if needed and rotate the user's credentials. Verify: Windows Update (or your patch management tool) shows the July 2022 or a later cumulative update installed (KB5015805 on the older versions listed above), and your vulnerability scanner no longer flags CVE-2022-30190. If you used the workaround, restore the key once patched. Sources: https://www.microsoft.com/en-us/msrc/blog/2022/05/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190 https://nvd.nist.gov/vuln/detail/CVE-2022-30190