^{CVE-2020-1143:}Win32k Elevation of Privilege Vulnerability in Windows kernel-mode driver

Overview

This vulnerability affects the Windows kernel-mode driver (Win32k) and stems from improper handling of objects in memory. An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. To exploit this vulnerability, an attacker would first need to log on to the system, then run a specially crafted application designed to exploit the vulnerability and take control of an affected system.

The vulnerability impacts various Windows operating systems and requires local access to exploit. The severity is heightened because it allows privilege escalation from a standard user account to system-level privileges, effectively bypassing security restrictions.

Remediation

To address this vulnerability, Microsoft has released security updates. Organizations and users should apply the appropriate security patches from the May 2020 security update. The following remediation steps are recommended:

1. Apply the security update provided by Microsoft through Windows Update or Microsoft Update Catalog.
2. Ensure systems are configured to automatically apply security updates or implement a regular patching schedule.
3. Implement the principle of least privilege for user accounts to minimize the impact of potential exploits.
4. Consider implementing application control solutions to prevent unauthorized applications from running.
5. Keep all Windows systems up to date with the latest security patches.

For systems that cannot be immediately patched, consider implementing additional security controls to restrict access to affected systems and monitor for suspicious activities.

References

1. Microsoft Security Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1143
2. Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1143
3. Microsoft May 2020 Security Updates: https://msrc.microsoft.com/update-guide/releaseNote/2020-May