Google Project Zero security researchers have identified another Windows vulnerability that has been actively exploited in attacks.
The security bug is an integer overflow with roots in one of the IOCTLs that the Windows Kernel Cryptography Driver (cng.sys) supports, and it could lead to privilege escalation, including a sandbox escape.
Discovered by Google Project Zero researchers Mateusz Jurczyk and Sergei Glazunov and assigned CVE number CVE-2020-17087, the zero-day was discovered in IOCTL 0x390400, in the cng!CfgAdtpFormatPropertyBlock function.
“The Windows Kernel Cryptography Driver (cng.sys) exposes a DeviceCNG device to user-mode programs and supports a variety of IOCTLs with non-trivial input structures. It constitutes a locally accessible attack surface that can be exploited for privilege escalation,” Jurczyk explains.
Details on the vulnerability were submitted to the Google Project Zero discussion board on October 22. Because the flaw was already being exploited in attacks, the information was made public seven days later, as per Google’s policy (for bugs that are not targeted, vendors are given 90 days to patch).
The security researchers have published the source code of a proof-of-concept exploit for the vulnerability, which was tested on “an up-to-date build of Windows 10 1903 (64-bit).”
However, they note that the issue was likely introduced in Windows 7.
“A crash is easiest to reproduce with Special Pools enabled for cng.sys, but even in the default configuration the corruption of 64kB of kernel data will almost surely crash the system shortly after running the exploit,” Jurczyk says.
The vulnerability appears to have been exploited in targeted attacks, but not in incidents related to the U.S. elections.
“Microsoft has a customer commitment to investigate reported security issues and update impacted devices to protect customers. While we work to meet all researchers’ deadlines for disclosures, including short-term deadlines like in this scenario, developing a security update is a balance between timeliness and quality, and our ultimate goal is to help ensure maximum customer protection with minimal customer disruption,” a Microsoft spokesperson said, replying to a SecurityWeek inquiry.
*updated with statement from Microsoft
Related: Microsoft’s Patch for LSASS Flaw Incomplete, Google Researcher Says
Related: Google Analysis of Zero-Days Exploited in 2019 Finds ‘Detection Bias’
Related: Google Project Zero Updates Vulnerability Disclosure Policy
Related: Google Researchers Detail Critical iMessage Vulnerability