CVE-2020-1584: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability (CVE-2020-1584) exists in the way that the dnsrslvr.dll handles objects in memory. The vulnerability was disclosed on August 17, 2020, affecting various Windows versions including Windows 10 (versions 1803, 1809, 1909, 2004) and Windows Server 2019 (AttackerKB).

The vulnerability stems from an integer overflow issue in multiple record copying functions within dnsrslvr.dll, including SigRecordCopy, NsecRecordCopy, KeyRecordCopy, OptRecordCopy, DhcidRecordCopy, and Nsec3RecordCopy. The bug occurs during heap allocation size calculations where adding values like 0x28 to AX register could cause an overflow, resulting in an undersized heap buffer allocation. This undersized buffer is then used in subsequent memcpy operations, potentially leading to a heap overflow condition. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) (AttackerKB).

A successful exploitation of this vulnerability could allow an attacker to execute code with elevated permissions, effectively gaining privileged access to the affected system. The vulnerability affects the process heap, which while more challenging to exploit than stack overflows, can still be leveraged for reliable control under certain conditions (AttackerKB).

To exploit this vulnerability, an attacker needs local authentication and must be able to run a specially crafted application. The exploitation likely requires setting up a malicious DNS server and triggering queries to it, with the malicious response being cached by the DNS resolver. When the same query is made again, the vulnerable record copying functions would be called, potentially triggering the heap overflow (AttackerKB).

Microsoft has addressed this vulnerability by releasing a security update that ensures dnsrslvr.dll properly handles objects in memory. The fix includes the addition of a new UShortAdd function to properly handle integer calculations (AttackerKB).