CVE-2020-17087Active Exploitation(microsoft / windows_10_1507)

CVE-2020-17087 is a Windows kernel privilege escalation vulnerability in cng.sys. The bug is a pool buffer overflow caused by a 16-bit integer truncation in "cng!CfgAdtpFormatPropertyBlock". A crafted IOCTL ("0x390400") can cause the kernel to allocate a buffer that's too small, leading to kernel pool corruption. It was exploited in the wild as part of a Chrome sandbox escape and is an excellent case study in IOCTL handling, integer truncation, and kernel pool exploitation.

Windows kernel bug - CVE-2020-17087 - https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2020/CVE-2020-17087.html The vulnerability was in the Windows Kernel Pool and boiled down to an integer truncation bug. A carefully crafted allocation caused the kernel to reserve less memory than expected, leading to a pool overflow that could corrupt neighboring objects. Attackers chained this with a browser exploit, gained arbitrary kernel read/write, and elevated themselves to SYSTEM.