CVE-2020-17056: 
vulnerability analysis and mitigation

Windows Network File System Information Disclosure Vulnerability (CVE-2020-17056) was disclosed and patched in November 2020 as part of Microsoft's Patch Tuesday updates. This vulnerability affects Windows Network File System (NFS) running on various Windows versions including Windows 10 and Windows 8.1 (Trend Micro).

The vulnerability is classified with a CVSS 3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. When exploited, this information disclosure vulnerability can provide unintentional read access to memory content in the kernel space from a user-mode process (NVD, Trend Micro).

If successfully exploited, the vulnerability allows attackers to gain unauthorized read access to kernel memory content from a user-mode process, potentially exposing sensitive information (Trend Micro).

The vulnerability requires local access and low privileges for exploitation. No known exploits in the wild have been reported at the time of disclosure (NVD).

Microsoft released security patches to address this vulnerability as part of the November 2020 Patch Tuesday updates. The fix is available through Windows Update and should be applied as soon as possible. Trend Micro's Deep Security and Vulnerability Protection solutions provide additional protection through rule 1010605 (Trend Micro).