CVE-2020-17012: 
vulnerability analysis and mitigation

The Windows Bind Filter Driver Elevation of Privilege Vulnerability (CVE-2020-17012) was discovered and reported on August 5, 2020, with public disclosure occurring on November 11, 2020. This vulnerability affects multiple versions of Microsoft Windows, including Windows 10 (versions 1803, 1903, 1909) and Windows Server 2016 (versions 1903, 1909) (NVD, ZDI).

The vulnerability exists within the bindflt.sys driver and involves a crafted request with an IOCTL of 0x220000 that can perform remapping of directories. The severity of this vulnerability is rated as HIGH with a CVSS v3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). This indicates that the vulnerability requires local access, low complexity to exploit, and low privileges, but can result in high impacts to confidentiality, integrity, and availability (ZDI, NVD).

If successfully exploited, this vulnerability allows local attackers to escalate privileges and execute code in the context of SYSTEM. This means an attacker could gain full system privileges, potentially leading to complete system compromise (ZDI).

To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system. The vulnerability can then be leveraged through a specific crafted request to escalate privileges (ZDI).

Microsoft has released a security update to address this vulnerability. Users are advised to apply the security patch available through the Microsoft security advisory (Microsoft Advisory, ZDI).