CVE-2020-0617: Hyper-V Denial of Service Vulnerability

Overview

Severity

Medium (CVSS 5.3)

CVSS Vector

CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C

Category

Denial of Service

Exploit Status

Not Exploited

Patch Tuesday

2020-Jan

Released

2020-01-14

EPSS Score

0.41% (percentile: 61.5%)

Description

A denial of service vulnerability exists when Microsoft Hyper-V Virtual PCI on a host server fails to properly validate input from a privileged user on a guest operating system. To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash. To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application. The security update addresses the vulnerability by properly validating input.

Affected Products (10)

Windows

• Windows 10 Version 1803 for x64-based Systems
• Windows Server, version 1803 (Server Core Installation)
• Windows 10 Version 1809 for x64-based Systems
• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows 10 Version 1709 for x64-based Systems
• Windows 10 for x64-based Systems
• Windows 10 Version 1607 for x64-based Systems
• Windows Server 2016
• Windows Server 2016 (Server Core installation)

Security Updates (5)

• 4534293
• 4534273
• 4534276
• 4534306
• 4534271

Acknowledgments

HongZhenhao of IceSword Lab, Qihoo 360

Revision History

• 2020-01-14: Information published.