Double-free vulnerability: Update to Visual Studio 17.5.5 ASAP!!!

Fellow IT Managers, and .NET Developers! It's time for another update from the world of Visual Studio. We recently informed you guys about the major vulnerability fix in the previous update, and now we're thrilled to bring your attention to the latest release: Visual Studio 17.5.5. Released on May 1st, 2023, this update comes packed with important fixes and improvements that you don't want to miss.

In this release, Microsoft addressed several key issues that enhance the stability and security of your development environment. Here are some notable highlights:

1. Fix for intermittent Visual Studio crash while scrolling Windows Forms .NET designer.

2. Marking .NET 3.1 as out of support in the Visual Studio setup UI, ensuring better visibility and the option to remove it using the new "Remove out of support components" button in Visual Studio setup.

Additionally, they made some essential fixes in the previous release, Visual Studio 17.5.4, that deserve your attention:

1. Resolved crash when invalid input is sent to the driver used during PGO training for kernel mode drivers.

2. Improved MSVC template operator resolution with ISO C++17 and ISO C++20 support.

3. Enhanced MSVC ASAN (AddressSanitizer) behavior to ignore mapped-memory files when manipulating memory using Rtl* memory functions.

4. Updates to .NET MAUI, iOS, and Android versions, incorporating the latest features and improvements.

5. Addressed a fix in the configuration API that eliminates a potential double-free vulnerability.

6. Improved trust warning visibility in the VSIXInstaller UI to ensure a secure installation experience.

Double Free VS Attack Overview

A double free vulnerability is a type of software vulnerability that occurs when a program attempts to free a memory block that has already been freed. This can lead to various security issues and potential exploitation by malicious actors.

When a program dynamically allocates memory, it reserves a block of memory for use and keeps track of its address. The program later deallocates or frees this memory when it is no longer needed, allowing the operating system to reclaim the memory for other purposes. However, in the case of a double free vulnerability, the program mistakenly frees the memory block more than once.

Exploiting a double free vulnerability typically involves manipulating the program's memory management to gain unauthorized access or execute arbitrary code. By carefully crafting a sequence of actions or inputs, an attacker can trick the program into performing unintended operations or accessing invalid memory locations. This can lead to a range of consequences, such as crashing the program, corrupting data, escalating privileges, or even executing malicious code.

The importance of patching this vulnerability lies in mitigating the risk of exploitation. The patch released in Visual Studio 17.5.5 specifically addresses the double free vulnerability in the configuration API. By applying this patch, developers can ensure that the API functions correctly, eliminating the potential for attackers to exploit this vulnerability and compromise the security of their applications.

Keeping software up to date with the latest patches and security fixes is crucial for maintaining a secure development environment. By promptly installing updates like Visual Studio 17.5.5, developers can protect their codebase and reduce the risk of exploitation, reinforcing the overall security posture of their software applications.

At Cognitive Generation Enterprises (CGE), we recognize the significance of staying up to date with the latest tools and technologies. As a technology-driven company, we prioritize ensuring the security and efficiency of your development processes. We understand the challenges that arise from managing complex software ecosystems and maintaining compliance.

We invite you to consider CGE as your backup Managed Service Provider (MSP) for compliance purposes. Our team of experts is equipped to assist you in maintaining a secure and compliant development environment, allowing you to focus on what you do best: creating exceptional software solutions.

So, don't delay! Update your Visual Studio to version 17.5.5 and take advantage of the latest fixes and improvements. Join us in fortifying your development journey against vulnerabilities and enjoy a seamless and secure coding experience.

Together, let's embrace the future of innovation and empower your team with the tools they need to succeed.

Stay secure, stay innovative!

Robert Green, MBA.

CEO, Cognitive Generation Enterprises