Windows kernel vulnerability disclosed by Google's Project Zero after bug exploited in the wild by hackers

Google's Project Zero bug-hunting team has disclosed a Windows kernel flaw that's being actively exploited by miscreants to gain control of computers.

The web giant's bug report was privately disclosed to Microsoft on October 22, and publicly revealed just seven days later, after it detected persons unknown exploiting the programming blunder. The privilege-escalation issue was identified by Mateusz Jurczyk and Sergei Glazunov of Google Project Zero.

"The Windows Kernel Cryptography Driver (cng.sys) exposes a \Device\CNG device to user-mode programs and supports a variety of IOCTLs with non-trivial input structures," the bug report explains. "It constitutes a locally accessible attack surface that can be exploited for privilege escalation (such as sandbox escape)."

The flaw, designated as CVE-2020-17087, is the result of improper 16-bit integer truncation that can lead to a buffer overflow. It can be exploited to, for instance, break out of Chrome's sandbox, and gain control of the victim's PC.

The Google researchers have posted PoC exploit code tested on Windows 10 1903 (64-bit). They say the cng.sysflaw looks to have been present since at least Windows 7. The Project Zero report says that Shane Huntley, director of Google's Threat Analysis Group, has confirmed that active exploitation is targeted and "is not related to any US election-related targeting."

First, Patch Tuesday. Now, Oh Hell, Monday: Microsoft emits bonus fixes for Visual Studio, Windows 10 security bugs

READ MORE

A patch is expected by November 10, 2020, which would be the next "Patch Tuesday" from Microsoft.

In an emailed statement, a Microsoft spokesperson said the company is working on a fix and characterized the known targeted attack as limited.

"Microsoft has a customer commitment to investigate reported security issues and update impacted devices to protect customers," the spokesperson said.

"While we work to meet all researchers’ deadlines for disclosures, including short-term deadlines like in this scenario, developing a security update is a balance between timeliness and quality, and our ultimate goal is to help ensure maximum customer protection with minimal customer disruption."

However, the Windows giant suggested exploitation would be difficult because an attacker would first need to compromise a host machine and then exploit another vulnerability of the local system. Microsoft says the only known remote-based attack chain for this vulnerability has been dealt with, a hole in Chromium-based browsers (CVE-2020-15999) that was fixed this month. ®