CVE-2020-1047: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability exists in Windows Hyper-V when the host server fails to properly handle objects in memory. The vulnerability was assigned CVE-2020-1047 and affects various versions of Windows 10 and Windows Server. This vulnerability was disclosed and addressed by Microsoft as part of their security updates (Microsoft Advisory).

The vulnerability received a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability requires local access and low privileges to exploit, but can result in high impacts to confidentiality, integrity, and availability. Under CVSS v2.0, it received a Base Score of 7.2 (HIGH) with vector (AV:L/AC:L/Au:N/C:C/I:C/A:C) (NVD).

If successfully exploited, this vulnerability could allow an attacker to gain elevated privileges on a target operating system. While the vulnerability itself does not directly allow arbitrary code execution, it could be combined with other vulnerabilities (such as remote code execution and another elevation of privilege) to take advantage of the elevated privileges (Microsoft Advisory).

The vulnerability requires local access and low privileges to exploit. It cannot be used alone for arbitrary code execution but could be chained with other vulnerabilities to achieve greater impact (NVD).

Microsoft addressed this vulnerability by correcting how Windows Hyper-V handles objects in memory. Users should apply the appropriate security updates provided by Microsoft to mitigate this vulnerability (Microsoft Advisory).