CVE-2020-1152: Windows Win32k Elevation of Privilege Vulnerability

Overview

Severity

Medium (CVSS 5.8)

CVSS Vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

More Likely

Patch Tuesday

2020-Sep

Released

2020-09-08

EPSS Score

0.19% (percentile: 40.5%)

Description

An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited the vulnerability could gain elevated privileges on a targeted system. To exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how Windows handles calls to Win32k.

Affected Products (36)

Other

• 11497
• 11498
• 11563
• 11568
• 11569
• 11570
• 11571
• 11572
• 11712
• 11713
• 11714
• 11715
• 11453
• 11454
• 11583
• 11644
• 11645
• 11646
• 11647
• 11766
• 11767
• 11768
• 11769
• 10729
• 10735
• 10852
• 10853
• 10816
• 10855
• 10481
• 10482
• 10484
• 10378
• 10379
• 10483
• 10543

Security Updates (11)

• 4577032
• 4570333
• 4574727
• 4577041
• 4571756
• 4577049
• 4577015
• 4577066
• 4577071
• 4577038
• 4577048

Acknowledgments

Jarvis_1oop of Pinduoduo Security Research Lab

Revision History

• 2020-09-08: Information published.