Microsoft Fixes Windows Zero-day Disclosed By Google Last Month

Microsoft has fixed today a Windows kernel zero-day vulnerability exploited in the wild as part of targeted attacks and publicly disclosed by Project Zero, Google’s 0day bug-hunting team, last month.

According to Project Zero researchers Mateusz Jurczyk and Sergei Glazunov who discovered it, the security flaw currently tracked as CVE-2020-17087 is a pool-based buffer overflow found in the Windows Kernel Cryptography Driver (cng.sys).

“The bug resides in the cng!CfgAdtpFormatPropertyBlock function and is caused by a 16-bit integer truncation issue,” the researchers explained.

Microsoft tagged the bug with a CVSS:3.0 severity rating of 7.8/10 saying that it can be exploited by local attackers with low privileges for privilege escalation (including sandbox escape) in low complexity attacks not requiring user interaction.

CVE-2020-17087 affects desktop systems running Windows 7 or later and servers running Windows Server 2008 and higher.

Security updates for all impacted Windows platforms are available on Microsoft’s MSRC (Microsoft Security Response Center) portal.

Also Read: A Look at the Risk Assessment Form Singapore Government Requires

Proof of concept exploits available

At least one functional proof-of-concept (PoC) exploit is available as Microsoft says, with the exploit code working in most situations where the flaw exists.

Project Zero provided a PoC exploit when it disclosed the bug on October 30, 2020, that can be used to crash unpatched Windows devices even for default system configurations.

Google’s researchers tested their PoC on an up-to-date build of Windows 10 1903 (64-bit) and confirmed at the time that the vulnerability was believed to be present since at least Windows 7.

The ongoing attacks exploiting this zero-day detected by Project Zero last month were not related to the U.S. election according to Google’s TAG group which researches government-backed attacks targeting the company’s users.

“We have confirmed with the Director of Google’s Threat Analysis Group, Shane Huntley, that this is targeted exploitation and this is not related to any US election-related targeting,” said Ben Hawkes, technical team lead of Google’s Project Zero security research team.

Due to the vulnerability being actively exploited in the wild, Project Zero disclosed it way before the default 90-day disclosure deadline was reached, after 7 days of being added to the Project Zero issue tracker.

Also Read: How to Send Mass Email Without Showing Addresses: 2 Great Workarounds

Project Zero’s researchers also disclosed three actively exploited zero-days impacting Apple devices running iOS, macOS, iPadOS, watchOS, and tvOS platforms. The company patched them all last week, on November 5.