CVE-2020-17087

What is the Windows Kernel Component Here?

The vulnerability sits in the Windows kernel's cryptography-related driver stack (cng.sys), part of the OS's core privileged code. A local privilege-escalation bug in kernel code is the second half of nearly every complete browser exploitation chain: a browser bug gets an attacker code execution inside a sandboxed renderer process, and a kernel bug is what lets them break out of that sandbox to control the full operating system.

Overview

CVE-2020-17087 is a Windows kernel privilege-escalation vulnerability that Google's Project Zero discovered being actively exploited in the wild in October 2020 as part of a real-world attack chain, paired with a Chrome Freetype 0-day. Because the bug was under active exploitation, Project Zero applied its expedited 7-day disclosure policy — publishing technical details before Microsoft had a fix ready — a notably compressed and controversial disclosure timeline. Microsoft shipped the official patch three weeks later, in the November 2020 Patch Tuesday (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High).

Technical Details

The flaw (CWE-131, incorrect calculation of buffer size) is a buffer-related bug in the kernel's cryptography driver stack that a local, low-privileged attacker can exploit to escalate to SYSTEM-level privileges. In the observed real-world attack chain, this bug served as the sandbox-escape component: an initial Chrome renderer-process compromise (via a separate Freetype vulnerability) had no path to full system control until it was paired with this kernel bug.

Discovery

Discovered and disclosed by Google Project Zero, which observed the bug being exploited in the wild as part of a live attack chain and applied its policy of disclosing actively-exploited 0-days within 7 days regardless of vendor patch availability — resulting in public technical details being available before Microsoft's official fix shipped.

Exploitation Context

This CVE is one of the clearer documented examples of a full browser-to-kernel exploitation chain observed in active use: a Chrome renderer bug for initial code execution, and this Windows kernel bug for sandbox escape and full system compromise. See also CVE-2020-16013 and CVE-2020-16009 (also enriched on this site) for related Chromium V8 0-days from the same general period that followed the same two-stage chain pattern.

Remediation

1. Apply Microsoft's November 2020 Patch Tuesday update immediately — Project Zero's public disclosure preceded the official patch by roughly three weeks, meaning the vulnerability was public and known to be actively exploited before most organizations had a fix available.
2. Patch browsers alongside the OS. A fully patched Windows kernel doesn't help if the browser-side renderer bug used for initial access remains unpatched, and vice versa — both halves of a chain like this need to be closed.
3. Deploy endpoint detection capable of identifying anomalous kernel-level privilege escalation, particularly on systems used by high-risk individuals who may be targeted with sophisticated exploit chains.
4. Treat any system that was unpatched through the October–November 2020 disclosure window as a potential compromise candidate given the confirmed in-the-wild exploitation and expedited public disclosure.