CVE-2020-17087: 
vulnerability analysis and mitigation

Windows Kernel Local Elevation of Privilege Vulnerability (CVE-2020-17087) is a critical security flaw discovered in the Windows Kernel Cryptography Driver (cng.sys). The vulnerability has been present since at least Windows 7 and affects multiple versions of the Windows operating system. The flaw was disclosed by Google's Project Zero team after evidence of active exploitation in the wild (Hacker News).

The vulnerability is a buffer overflow issue in the cng!CfgAdtpFormatPropertyBlock function caused by a 16-bit integer truncation issue. It has received a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access requirements with high impacts on confidentiality, integrity, and availability (NVD).

When successfully exploited, this vulnerability allows an attacker to escalate privileges on the affected system. The flaw was particularly concerning as it was being used in combination with a Chrome browser zero-day (CVE-2020-15999) to escape Chrome's sandbox protections and execute malicious code on Windows systems (Hacker News).

The vulnerability was actively exploited in the wild as part of an exploit chain. Google's Project Zero team released a proof-of-concept exploit that demonstrated the ability to corrupt kernel data and crash vulnerable Windows devices under default system configurations (Hacker News).

Microsoft released security patches to address this vulnerability on November 10, 2020. The fix was distributed through various KB updates for affected Windows versions, including Windows 10, Windows Server 2016, and Windows Server 2019 (Rapid7).

Google's Project Zero team defended their decision to disclose the vulnerability with a 7-day deadline, citing defensive utility in sharing the details and the unlikelihood of opportunistic attacks. They also noted that the exploitation was not related to any US election-related targeting (Hacker News).