Microsoft Windows 10 1903/10 1909/Server 1903/Server 1909 Token Security Feature injection

Summaryinfo

A vulnerability marked as critical has been reported in Microsoft Windows 10 1903/10 1909/Server 1903/Server 1909. This vulnerability affects unknown code of the component Token Security Feature. Performing a manipulation results in injection. This vulnerability is known as CVE-2020-0981. Attacking locally is a requirement. Furthermore, an exploit is available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in Microsoft Windows 10 1903/10 1909/Server 1903/Server 1909 (Operating System). This affects an unknown code of the component Token Security Feature. The manipulation with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.An attacker who successfully exploited the vulnerability could allow an application with a certain integrity level to execute code at a different integrity level, leading to a sandbox escape.The update addresses the vulnerability by correcting how Windows handles token relationships, aka 'Windows Token Security Feature Bypass Vulnerability'.

The weakness was published 04/14/2020 as confirmed security update guide (Website). It is possible to read the advisory at portal.msrc.microsoft.com. The public release has been coordinated with Microsoft. This vulnerability is uniquely identified as CVE-2020-0981. Attacking locally is a requirement. A authentication is needed for exploitation. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1055 according to MITRE ATT&CK. The advisory points out:

A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.

The exploit is shared for download at packetstormsecurity.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Similar entries are available at VDB-153259, VDB-153257 and VDB-153256. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 10 1903
• 10 1909
• Server 1903
• Server 1909

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion