CVE-2020-17057: 
vulnerability analysis and mitigation

Windows Win32k Elevation of Privilege Vulnerability (CVE-2020-17057) was discovered and disclosed in November 2020. The vulnerability affects Microsoft Windows systems, specifically within the DirectComposition implementation in the Windows kernel. This security flaw was assigned a CVSS v3.1 base score of 7.8 (High) by NIST and 7.0 (High) by Microsoft (NVD).

The vulnerability exists within the DirectComposition implementation in the Windows kernel, where crafted parameters to a system call can trigger access to a pointer prior to initialization. The vulnerability received varying CVSS scores, with NIST assigning a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Microsoft assessed it as CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (ZDI, NVD).

The vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. A successful exploit could enable an attacker to execute code in the context of the kernel, effectively gaining elevated privileges on the target system (ZDI).

To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system. The vulnerability requires local access and low privileges to exploit (ZDI).

Microsoft has released security updates to address this vulnerability. The fixes are available through various KB updates including KB4586781, KB4586785, KB4586786, KB4586793, and KB4586830 for affected Windows versions (Rapid7).