Low
CVE-2020-0753
CVE-2020-0753
Description
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka ‘Windows Error Reporting Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2020-0754.
Add Assessment
Technical Analysis
A technical writeup for this bug was published today and is available at https://github.com/afang5472/CVE-2020-0753-and-CVE-2020-0754/blob/master/WERReport-CVE-2020-0753/POC.md along with a working PoC. The vulnerability itself exists within CWerService::SvcMergeETWLogs within Wersvc.dll according to the writeup.
From what I can see in the writeup the bug is a race condition which is relatively difficult to exploit, however because it is within the Windows Error Reporting Service it should be available by default on most Windows systems. Successful exploitation will result in arbitrary file deletion as the SYSTEM user.
Rated this as medium on exploitation as whilst it is a race condition, the fact that one is able to gain a 4-5 second window to exploit the bug by taking advantage of how the GetTempFileNameW() operation works. for generating the temp file name. Basically by prepopulating a directory with all file names from WER0000.tmp to WERFFFE.tmp (aka 0000 to FFFE), one forces GetTempFileNameW() to generate a file with the name WERFFFF.tmp.
Then following steps are executed (taken from writeup):
Then , I put all the WER***.tmp in \(pwd\1\, and junction \)pwd\2\ –> $pwd\1\;
we create a process to continuously trigger this function with the path \(pwd\2\. and create the other process to continuously execute the command SetOplock \)pwd\1\WERFFFF.tmp;
Once the Oplock is triggered , we junction \(pwd\2\ -> \RPC CONTROL\, and then create object symbolic \RPC CONTROL\WERFFFF.tmp -> \)target and \RPC CONTROL\WERFFFF.tmp.etl –> $target
Release the oplock , the target file will be deleted with system privilege
CVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- windows 10 -,
- windows 10 1607,
- windows 10 1709,
- windows 10 1803,
- windows 10 1809,
- windows 10 1903,
- windows 7 -,
- windows 8.1 -,
- windows rt 8.1 -,
- windows server 2008 -,
- windows server 2008 r2,
- windows server 2012 -,
- windows server 2012 r2,
- windows server 2016 -,
- windows server 2016 1803,
- windows server 2016 1903,
- windows server 2016 1909,
- windows server 2019 -
