Overview
Zero-Day Vulnerability in Windows (CVE-2020-17087): “Windows Kernel Local Elevation of Privilege Vulnerability”
Description
A zero-day vulnerability (CVE-2020-17087) that exist in Windows has been disclosed by Google’ Project Zero researchers. The vulnerability stems from a flaw that resides in the Windows Kernel Cryptography Driver (cng.sys).
The identified vulnerability (CVE-2020-17087) is an Elevation of Privilege (Pool-Based Buffer Overflow) type vulnerability and it is believed to be exploited actively in the wild. The vulnerability stems from a buffer overflow issue at the input/output controller processing in the cng.sys. Exploiting the vulnerability, locally accessible attackers could initiate privilege escalation attacks like sandbox escape.
Vulnerability affects a large number of Windows versions from Windows 10 through Windows 7 and Windows servers. A detailed list of products affected by the vulnerability are:
- Windows 10
- Windows 7
- Windows 7 sp1
- Windows 8.1
- Windows Server 2008 sp2
- Windows Server 2008 r2 sp2
- Windows Server 2012
- Windows Server 2012 r2
- Windows Server 2016
- Windows Server 2019
Impact
A local attacker can elevate his privilege (gain administrative privileges) by exploiting this vulnerability.
Impact Summary
Category: Elevation of Privilege
CVSS 3.1 Base Score: 7.8 High
CVSS 3.1 Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Solution (Update)
In order to remediate this vulnerability, affected products needs to be updated immediately. For more information about the updates/patches for this vulnerability, please refer to the Microsoft Security Advisory.
You can’t defend. You can’t prevent. The only thing you can do is detect and respond.
Bruce Schneier
Read more educational and inspirational cyber quotes at our page 100+ Best Cyber Security & Hacker Quotes.
References to Advisories, Solutions and Tools
To learn more about security vulnerabilities, you could also read our articles What is a Security Vulnerability? or What is Vulnerability Scanning?
