CVE-2020-0910: Windows Hyper-V Remote Code Execution Vulnerability

Overview

Severity

High (CVSS 8.4)

CVSS Vector

CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

Category

Remote Code Execution

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2020-Apr

Released

2020-04-14

EPSS Score

14.77% (percentile: 94.5%)

Description

A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code. An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system. The security update addresses the vulnerability by correcting how Hyper-V validates guest operating system user input.

Detection & Weaponization (1 sources)

Maturity: Exploit

• GitHub PoC: 1 repositories

Affected Products (7)

Windows

• Windows 10 Version 1809 for x64-based Systems
• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows 10 Version 1903 for x64-based Systems
• Windows Server, version 1903 (Server Core installation)
• Windows 10 Version 1909 for x64-based Systems
• Windows Server, version 1909 (Server Core installation)

Security Updates (2)

• 4549949
• 4549951

Acknowledgments

Microsoft Virtualization Security Team

Revision History

• 2020-04-14: Information published.