CVE-2020-0909: Windows Hyper-V Denial of Service Vulnerability

Overview

Severity

High (CVSS 7.5)

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C

Category

Denial of Service

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2020-May

Released

2020-05-12

EPSS Score

12.37% (percentile: 93.9%)

Description

A denial of service vulnerability exists when Hyper-V on a Windows Server fails to properly handle specially crafted network packets. To exploit the vulnerability, an attacker would send specially crafted network packets to the Hyper-V Server. The security update addresses the vulnerability by resolving the conditions where Hyper-V would fail to properly handle these network packets.

Affected Products (24)

Windows

• Windows 10 Version 1803 for x64-based Systems
• Windows Server, version 1803 (Server Core Installation)
• Windows 10 Version 1809 for x64-based Systems
• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows 10 Version 1709 for x64-based Systems
• Windows 10 Version 1903 for x64-based Systems
• Windows Server, version 1903 (Server Core installation)
• Windows 10 for x64-based Systems
• Windows 10 Version 1607 for x64-based Systems
• Windows Server 2016
• Windows Server 2016 (Server Core installation)
• Windows 8.1 for x64-based systems
• Windows Server 2012
• Windows Server 2012 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 R2 (Server Core installation)
• Windows 10 Version 1909 for x64-based Systems
• Windows Server, version 1909 (Server Core installation)

ESU

• Windows 7 for x64-based Systems Service Pack 1
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Security Updates (14)

• 4556807
• 4551853
• 4556812
• 4556799
• 4556826
• 4556813
• 4556836
• 4556843
• 4556846
• 4556853
• 4556860
• 4556854
• 4556840
• 4556852

Acknowledgments

Huichen Lin and Dong Seong Kim of <a href="https://www.itee.uq.edu.au/">School of Information Technology and Electrical Engineering - The University of Queensland</a>

Revision History

• 2020-05-12: Information published.