CVE-2020-16894: 
vulnerability analysis and mitigation

A denial of service vulnerability (CVE-2020-16894) was identified in Windows Network Address Translation (NAT) on host servers. The vulnerability stems from improper input validation from privileged users on guest operating systems. This vulnerability was initially recorded on August 4, 2020, and has undergone several modifications in its assessment (CVE MITRE).

The vulnerability received a CVSS v3.1 Base Score of 7.7 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. Under CVSS v2.0, it was rated with a Base Score of 6.8 (MEDIUM) with the vector (AV:N/AC:L/Au:S/C:N/I:N/A:C) (NVD).

When successfully exploited, this vulnerability could cause the host server to crash, resulting in a denial of service condition. The impact is particularly significant as it affects the Windows Network Address Translation functionality on host servers (CVE MITRE).

To exploit this vulnerability, an attacker needs to already have a privileged account on a guest operating system running as a virtual machine. The attacker could then run a specially crafted application that causes the host machine to crash (NVD).

Microsoft has addressed this vulnerability by modifying how Windows NAT accesses the host. A security update has been released to patch this vulnerability (Microsoft Advisory).