HTTP: Microsoft Windows Win32k Kernel Driver CVE-2020-1152 Privilege Escalation

This signature detects attempts to exploit a known vulnerability against Microsoft Win32k Kernel Driver. A successful attack can lead to elevation of privilege and arbitrary code execution.

Extended Description

An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited the vulnerability could gain elevated privileges on a targeted system. To exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how Windows handles calls to Win32k.

Affected Products

Microsoft windows_server_2016

References

CVE: CVE-2020-1152

Short Name

HTTP:STC:DL:CVE-2020-1152-PE

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP: Microsoft Windows Win32k Kernel Driver CVE-2020-1152 Privilege Escalation

Extended Description

Affected Products

References

Found a potential security threat?