CVE-2020-1206: 
vulnerability analysis and mitigation

An information disclosure vulnerability exists in Microsoft Server Message Block 3.1.1 (SMBv3) protocol, identified as CVE-2020-1206 and dubbed 'SMBleed'. The vulnerability affects the way SMBv3 protocol handles certain requests, specifically in the compression functionality. This flaw was discovered and disclosed as part of Microsoft's June 2020 Patch Tuesday release, affecting Windows 10 versions 1903, 1909, 2004, and corresponding Windows Server versions (MITRE CVE, NVD).

The vulnerability exists in the Srv2DecompressData function, the same function affected by the earlier SMBGhost vulnerability. SMBleed received a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The flaw is related to how the protocol handles compressed data packets, allowing potential information disclosure through uninitialized kernel memory read (Tenable Blog).

The vulnerability allows attackers to potentially read uninitialized kernel memory. When combined with the SMBGhost vulnerability (CVE-2020-0796), researchers demonstrated the possibility of achieving remote code execution through a chain dubbed 'SMBleedingGhost' (Tenable Blog).

While unauthenticated exploitation of SMBleed alone is described as 'less straightforward', researchers successfully developed a proof-of-concept that chains SMBleed with SMBGhost to achieve unauthenticated remote code execution. A technical proof-of-concept has been publicly released (PacketStorm PoC).

Microsoft released patches for this vulnerability as part of their June 2020 Patch Tuesday updates. For systems that cannot be immediately patched, Microsoft recommends disabling SMBv3 compression as a workaround. After applying the patches, the SMBv3 compression can be re-enabled (Microsoft Advisory).