CVE-2020-0796

What is SMBv3?

Server Message Block (SMB) is the core file-sharing and inter-process-communication protocol built into every Windows system, used for everything from mapped network drives to domain authentication traffic. Because it's enabled by default and rarely disabled, a wormable bug in SMB has historically been catastrophic — EternalBlue's exploitation of SMBv1 in WannaCry and NotPetya is the reference case every SMB vulnerability gets compared against.

Overview

CVE-2020-0796 — nicknamed "SMBGhost" — is a buffer overflow in how SMBv3.1.1 handles compressed message headers, allowing an unauthenticated remote attacker to execute code on either an SMB server or a client that connects to a malicious server. Its disclosure was unusually chaotic: Microsoft prepared the fix for its March 2020 Patch Tuesday, several antivirus and threat-intelligence vendors got early access to a bulletin that referenced the CVE, and details leaked publicly before Microsoft had actually shipped a patch — that patch had, in fact, been pulled from the March cycle. Microsoft released it out-of-band two days later, on March 12, 2020, as KB4551762.

Affected Versions

Older Windows releases (Windows 7, Windows Server 2016 and earlier) do not support SMBv3.1.1 compression and are not affected.

Technical Details

The flaw (CWE-119, improper restriction of operations within a memory buffer) is in srv2.sys, the SMBv3 server driver, and its client-side counterpart. When SMBv3.1.1 negotiates compression, a crafted packet with a manipulated compressed-data-length field causes an integer overflow that leads to a buffer overflow in kernel memory, giving an unauthenticated attacker code execution at the highest privilege level with a single malicious packet (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0 Critical). Because both server and client implementations parse compressed SMBv3.1.1 traffic, the bug is exploitable in both directions — a malicious server can attack a connecting client, not just the reverse.

Discovery

Credited to Microsoft's own internal engineering; the vulnerability became public through a disclosure process disrupted when third-party security vendors referenced it in blog posts and signature updates ahead of the official patch, forcing Microsoft's hand on the out-of-band release.

Exploitation Context

Public proof-of-concept code for local privilege escalation and denial-of-service followed within weeks of the patch. A companion information-disclosure bug, CVE-2020-1206 ("SMBleed"), was later combined with SMBGhost by researchers to build a more reliable remote code execution chain by defeating ASLR. CISA added CVE-2020-0796 to KEV in 2022 once sustained exploitation, including ransomware operators incorporating it into intrusion toolkits, was confirmed — reflected in this entry's ransomwareUse: true flag.

Remediation

1. Apply KB4551762 (or a later cumulative update that supersedes it) on every affected Windows 10 and Server 1903/1909 host immediately.
2. Disable SMBv3.1.1 compression as a stopgap on systems that cannot be patched immediately, via the registry (DisableCompression under the LanmanServer parameters key) — this blocks the vulnerable code path without disabling SMB entirely.
3. Block inbound and outbound SMB (TCP 445) at the network perimeter for any host that doesn't need to expose file sharing to the internet; SMB should never be directly internet-facing.
4. Treat any unpatched, internet-reachable SMBv3 host as a wormable-exploitation risk on par with pre-patch EternalBlue systems, and prioritize patching or isolation accordingly given confirmed use in ransomware intrusion chains.