CVE-2020-0909: 
vulnerability analysis and mitigation

A denial of service vulnerability (CVE-2020-0909) was identified in Microsoft Windows Hyper-V, affecting Windows Server systems. The vulnerability was discovered and assigned on November 4, 2019, and was publicly disclosed on May 21, 2020. The issue exists when Hyper-V on Windows Server fails to properly handle specially crafted network packets (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that it is network-accessible, requires low attack complexity, and needs no privileges or user interaction to exploit. The CVSS v2.0 base score is 5.0 (MEDIUM) with the vector (AV:N/AC:L/Au:N/C:N/I:N/A:P) (NVD).

The successful exploitation of this vulnerability can result in a denial of service condition on affected Hyper-V servers, potentially impacting the availability of virtualized resources and services running on the affected systems (NVD).

To exploit the vulnerability, an attacker would need to send specially crafted network packets to the Hyper-V Server. The attack can be performed remotely without requiring authentication or user interaction (NVD).

Microsoft has released security updates to address this vulnerability. The security update resolves the conditions where Hyper-V would fail to properly handle malicious network packets. Users are advised to apply the appropriate patches for their specific Windows version (Rapid7).