CVE-2020-0986
Microsoft Windows Kernel Privilege Escalation Vulnerability
Description
CVE-2020-0986 is a HIGH-severity privilege escalation vulnerability in the Microsoft Windows kernel with a CVSS 3.1 score of 7.8. The vulnerability exists when the Windows kernel fails to properly handle objects in memory, allowing an attacker to run arbitrary code in kernel mode. An attacker who successfully exploits this vulnerability could install programs, view, change, or delete data, or create new accounts with full user rights. Affected products include Windows 8.1, Windows 10 (builds 1507 through 2004), Windows RT 8.1, and Windows Server 1803 through 2019. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The EPSS score of 0.20650 (95.50th percentile) confirms significant exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 10 1903 | - |
| microsoft | windows 10 1909 | - |
| microsoft | windows 10 2004 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 1803 | - |
| microsoft | windows server 1903 | - |
| microsoft | windows server 1909 | - |
| microsoft | windows server 2004 | - |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/160698/Microsoft-Windows-splWOW64-Privilege-Escalation.html(Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0986(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0986(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2020-0986 is classified under CWE-787 — Out-of-bounds Write. This weakness occurs when software writes data past the end of an intended buffer, corrupting adjacent memory regions. In the kernel context, out-of-bounds write operations can overwrite critical kernel data structures, modify page table entries, or corrupt process tokens, all of which can lead to privilege escalation.
In the context of the Windows kernel, this vulnerability specifically involves improper handling of objects in memory by the splWOW64 component. The out-of-bounds write in the kernel's memory management allows a local attacker to escalate privileges from a standard user account to full SYSTEM-level access, bypassing all user-level security restrictions.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2020-0986 carries a CVSS 3.1 score of 7.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Kernel-level code execution grants the attacker unrestricted access to all data on the system, including credentials, encryption keys, security tokens, and data from all user accounts.
Integrity (HIGH): An attacker with kernel-level access can modify any system file, install rootkits, alter security configurations, disable security software, and manipulate audit logs.
Availability (HIGH): Exploitation can cause blue screen crashes, system instability, or total denial of service. A kernel-level attacker can terminate any process and disable any system service.
Scope Unchanged: Although the scope is technically Unchanged (U), kernel-level compromise effectively grants full control over the entire operating system and all hosted applications and data.
With an EPSS score of 0.20650 (95.50th percentile), this vulnerability has a very high probability of real-world exploitation.
Exploit Maturity
CVE-2020-0986 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: The vulnerability has been actively exploited in targeted attacks. Google Project Zero reported exploitation by an advanced threat actor using the vulnerability in an exploit chain. Public exploit code is available, including a Packet Storm Security advisory. The EPSS score of 0.20650 (95.50th percentile) confirms high exploitation activity.
Ransomware association: No direct ransomware association has been confirmed per KEV data. However, kernel privilege escalation vulnerabilities are commonly used in sophisticated attack chains including ransomware campaigns to gain full system control.
Attack surface: As a local privilege escalation targeting the splWOW64 component, an attacker needs initial code execution on the target. The vulnerability is commonly chained with browser or document-based remote code execution vulnerabilities for complete exploitation chains.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03.
Remediation
- Apply Microsoft security updates immediately. Install the June 2020 Patch Tuesday updates per Microsoft's advisory at portal.msrc.microsoft.com.
- Identify all affected systems. Inventory all Windows 8.1, Windows 10 (1507 through 2004), Windows RT 8.1, and Windows Server (1803 through 2019) systems in your environment.
- Implement defense-in-depth measures. Deploy application control policies, enable Attack Surface Reduction rules, and enforce least privilege access to minimize the risk from local privilege escalation.
- Monitor for exploitation indicators. Watch for suspicious activity related to the splWOW64 process, unexpected privilege escalations, and anomalous kernel-mode behavior in system event logs.
- Update endpoint protection tools. Ensure EDR solutions and antimalware software have current signatures targeting CVE-2020-0986 exploitation techniques.
- Assess exposure from chained attacks. Since this vulnerability is commonly used alongside remote code execution flaws, ensure all browser, document viewer, and email client patches are also current.
Technical Details
CVE-2020-0986 is a HIGH-severity privilege escalation vulnerability in the Windows kernel that requires local access and low privileges to exploit. No user interaction is required, and the attack complexity is low.
Technical mechanism: The vulnerability exists in the Windows kernel's handling of objects in memory, specifically in the splWOW64 component which provides 32-bit to 64-bit print driver compatibility. An attacker can send specially crafted data to splWOW64 that triggers an out-of-bounds write in kernel memory. By controlling the write destination and payload, the attacker can overwrite kernel data structures to escalate privileges from a standard user to SYSTEM.
CVSS 3.1 vector analysis: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — The local attack vector with low complexity and low privilege requirements makes this readily exploitable for any attacker with initial access. The lack of user interaction requirement means exploitation can be fully automated.
Known exploitation: Google Project Zero reported that this vulnerability was exploited in targeted attacks, chained with other vulnerabilities to achieve full system compromise. The splWOW64 exploitation technique was later refined and reused in CVE-2020-17008 and similar vulnerabilities.
Affected products: Windows 8.1, Windows 10 (1507 through 2004), Windows RT 8.1, and Windows Server 1803 through 2019.
Frequently Asked Questions
Is CVE-2020-0986 being actively exploited?
Yes, CVE-2020-0986 is being actively exploited. Google Project Zero reported targeted exploitation by an advanced threat actor. The vulnerability is listed in CISA's KEV catalog with a remediation deadline of 2022-05-03, and the EPSS score of 0.20650 (95.50th percentile) confirms significant real-world exploitation.
Which products are affected by CVE-2020-0986?
CVE-2020-0986 affects Microsoft Windows products including Windows 8.1, Windows 10 (builds 1507 through 2004), Windows RT 8.1, and multiple Windows Server versions (1803, 1903, 1909, 2004, 2012, 2016, 2019). All listed versions should be patched immediately.
How do I fix CVE-2020-0986?
Apply the June 2020 security updates from Microsoft. Implement defense-in-depth measures including application control, Attack Surface Reduction rules, and least privilege enforcement. Monitor for indicators of exploitation, particularly related to the splWOW64 component.
How severe is CVE-2020-0986?
CVE-2020-0986 is rated HIGH with a CVSS 3.1 score of 7.8. It allows local privilege escalation to kernel mode with low complexity, enabling complete system compromise. The EPSS score of 0.20650 (95.50th percentile) and confirmed exploitation by advanced threat actors underscore the urgency of remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.