CVE-2020-1075: 
vulnerability analysis and mitigation

An information disclosure vulnerability (CVE-2020-1075) exists in Windows Subsystem for Linux when it improperly handles objects in memory. This vulnerability was discovered and reported in November 2019, affecting multiple versions of Windows 10 and Windows Server (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The CVSS v2.0 Base Score is 2.1 (Low) with the vector (AV:L/AC:L/Au:N/C:P/I:N/A:N). This indicates that the vulnerability requires local access, has low attack complexity, requires low privileges, and can result in high confidentiality impact without affecting integrity or availability (NVD).

The vulnerability could allow an attacker to obtain information disclosure from the Windows Subsystem for Linux. The impact is limited to information disclosure without any compromise to system integrity or availability (NVD).

The vulnerability requires local access and low privileges to exploit. There are no known reports of this vulnerability being exploited in the wild (NVD).

Microsoft has released security updates to address this vulnerability. The fixes are available through various KB updates including KB4556807 for Windows 10 version 1803, KB4551853 for Windows 10 version 1809, KB4556799 for Windows 10 versions 1903 and 1909, and KB4551853 for Windows Server 2019 (Rapid7).