CVE-2020-0796
Microsoft SMBv3 Remote Code Execution Vulnerability
Description
CVE-2020-0796 is a CRITICAL improper restriction of operations within the bounds of a memory buffer vulnerability affecting Microsoft SMBv3, carrying a CVSS 3.1 score of 10. A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client. Affected products include Microsoft Windows 10 1903, Microsoft Windows 10 1909, Microsoft Windows Server 1903, Microsoft Windows Server 1909. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-08-10. CISA's KEV catalog confirms ransomware association for this vulnerability. With an EPSS score of 0.94408 (99.98th percentile), this vulnerability demonstrates significant real-world exploitation activity and should be prioritized for immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1903 | - |
| microsoft | windows 10 1909 | - |
| microsoft | windows server 1903 | - |
| microsoft | windows server 1909 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-Of-Concept.html(Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0796(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2020-0796 is classified under CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer. Improper Restriction of Operations within the Bounds of a Memory Buffer occurs when software performs operations on a memory buffer but can read from or write to a memory location that is outside the intended boundary of the buffer. This is the parent category for many specific buffer error types including buffer overflows (CWE-120), buffer underflows, out-of-bounds reads (CWE-125), and out-of-bounds writes (CWE-787). These vulnerabilities occur when array indexes, pointer arithmetic, or size calculations allow access beyond allocated memory regions.
In the context of Microsoft SMBv3, this weakness is particularly concerning because Memory buffer errors are consistently among the most exploited vulnerability classes. Out-of-bounds writes can overwrite adjacent memory including return addresses, function pointers, and security-critical data. Out-of-bounds reads can leak sensitive information including cryptographic keys and memory layout (defeating ASLR). Organizations using affected versions should understand that this vulnerability class has historically enabled severe compromises across enterprise environments.
Impact Analysis
CVE-2020-0796 carries a CVSS 3.1 score of 10 (CRITICAL) with Changed Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker extensive access to sensitive data processed by Microsoft SMBv3, including configuration files, credentials, and potentially data from connected systems.
Integrity (HIGH): Attackers can modify critical system files, install backdoors, alter configurations, or deploy malware on affected systems running Microsoft SMBv3.
Availability (HIGH): Complete disruption of the affected service or system is possible, including denial of service, system crashes, or rendering the product inoperable.
Scope Changed: The vulnerability's scope is Changed (C), meaning exploitation can affect resources beyond the vulnerable component itself. This extends the potential blast radius significantly, as compromising Microsoft SMBv3 may provide a foothold to attack other connected systems and resources.
With an EPSS score of 0.94408 (99.98th percentile), this vulnerability ranks among the most likely to be exploited in real-world attacks, underscoring the urgency of remediation.
Exploit Maturity
CVE-2020-0796 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been actively exploited, as confirmed by its inclusion in the KEV catalog. The EPSS score of 0.94408 (99.98th percentile) places it among the most exploited vulnerabilities tracked.
Ransomware association: CISA's KEV catalog confirms a known association between CVE-2020-0796 and ransomware campaigns. Threat actors have leveraged this vulnerability as part of ransomware attack chains for initial access or lateral movement.
Public exploits: Exploit code is publicly available, including references at packetstormsecurity.com and packetstormsecurity.com. The availability of public exploit code significantly lowers the barrier to exploitation.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-08-10. All organizations should treat this deadline as a strong recommendation for their own remediation timelines.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Consult the vendor advisory at portal.msrc.microsoft.com for specific patch guidance.
- Verify affected product versions in your environment. Identify all instances of Microsoft SMBv3 in your infrastructure (affected versions: Microsoft Windows 10 1903, Microsoft Windows 10 1909, Microsoft Windows Server 1903, Microsoft Windows Server 1909). Use asset inventory and vulnerability scanning tools to ensure no instances are missed.
- Implement interim mitigations if patching is delayed. If immediate patching is not feasible, apply network-level controls such as restricting access to the affected component, enabling enhanced logging, and monitoring for indicators of compromise.
- Scan for signs of prior exploitation. Given the confirmed active exploitation of this vulnerability, review system logs and security monitoring data for evidence of compromise. Conduct a thorough investigation if any suspicious activity is detected.
- Update detection signatures and monitoring rules. Ensure intrusion detection and prevention systems, endpoint detection tools, and SIEM rules are updated to detect exploitation attempts targeting CVE-2020-0796.
- Conduct a post-remediation review. After patching, verify the fix is effective and document the remediation actions taken. Update your vulnerability management records and assess whether any additional hardening measures are warranted.
Technical Details
CVE-2020-0796 is a CRITICAL-severity vulnerability in Microsoft SMBv3 that can be exploited remotely over the network without physical access. The attack complexity is low, meaning no specialized conditions or preparation are required beyond the attack prerequisites. No prior authentication or privileges are needed to initiate the attack. No user interaction is required, allowing fully automated exploitation once the target is accessible.
Technical mechanism: A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client. The underlying flaw relates to improper restriction of operations within the bounds of a memory buffer, where Improper Restriction of Operations within the Bounds of a Memory Buffer occurs when software performs operations on a memory buffer but can read from or write to a memory location that is outside the intended boundary of the buffer. This is the parent category for many specific buffer error types including buffer overflows (CWE-120), buffer underflows, out-of-bounds reads (CWE-125), and out-of-bounds writes (CWE-787).
CVSS 3.1 vector analysis: The vector reflects an Attack Vector of NETWORK, Attack Complexity of LOW, Privileges Required of NONE, User Interaction of NONE, Scope CHANGED, and impact ratings of HIGH/HIGH/HIGH for Confidentiality/Integrity/Availability respectively. The Changed scope indicates that exploitation can cascade beyond the initially compromised component.
Frequently Asked Questions
What is CVE-2020-0796?
CVE-2020-0796 is a CRITICAL-severity vulnerability (CVSS 10) in Microsoft SMBv3 that a remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client. It is listed in CISA's Known Exploited Vulnerabilities catalog, confirming real-world exploitation. This vulnerability has been associated with ransomware campaigns.
Which products are affected by CVE-2020-0796?
The affected products include Microsoft Windows 10 1903, Microsoft Windows 10 1909, Microsoft Windows Server 1903, Microsoft Windows Server 1909. Organizations running any of these versions should verify their exposure and prioritize remediation. Multiple product versions and configurations are affected, making thorough asset inventory essential.
How do I fix CVE-2020-0796?
Apply updates per vendor instructions. Ensure all affected instances of Microsoft SMBv3 are identified using vulnerability scanning and asset management tools. If immediate patching is not possible, implement network-level mitigations and enhanced monitoring. After patching, verify the fix and scan for indicators of prior compromise.
How severe is CVE-2020-0796?
CVE-2020-0796 is rated CRITICAL with a CVSS 3.1 score of 10. Its EPSS score of 0.94408 places it in the 99.98th percentile for exploitation likelihood. The vulnerability has confirmed active exploitation in the wild and is associated with ransomware campaigns, was required to be remediated by federal agencies by 2022-08-10 per CISA's KEV directive.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.