Google reveals a new Windows zero-day bug it says is under active attack
Google has dropped details of a previously undisclosed vulnerability in Windows, which it says hackers are actively exploiting. As a result, Google gave Microsoft just a week to fix the vulnerability. That deadline came and went, and Google published details of the vulnerability this afternoon.
The vulnerability has no name but is labeled CVE-2020-17087, and affects at least Windows 7 and Windows 10.
Google's Project Zero, the elite group of security bug hunters which made the discovery, said the bug allows an attacker to escalate their level of user access in Windows. Attackers are using the Windows vulnerability in conjunction with a separate bug in Chrome, which Google disclosed and fixed last week. This new bug allows an attacker to escape Chrome's sandbox, normally isolated from other apps, and run malware on the operating system.
In a tweet, Project Zero's technical lead Ben Hawkes said Microsoft plans to issue a patch on November 10.
Microsoft didn't independently confirm this date when asked, but said in a statement: Microsoft has a customer commitment to investigate reported security issues and update impacted devices to protect customers. While we work to meet all researchers' deadlines for disclosures, including short-term deadlines like in this scenario, developing a security update is a balance between timeliness and quality, and our ultimate goal is to help ensure maximum customer protection with minimal customer disruption."
In addition to last week's Chrome/freetype 0day (CVE-2020-15999), Project Zero also detected and reported the Windows kernel bug (CVE-2020-17087) that was used for a sandbox escape. The technical details of CVE-2020-17087 are now available here: https://t.co/bO451188Mk
- Ben Hawkes (@benhawkes) October 30, 2020
But it's unclear who the attackers are or their motives. Google's director of threat intelligence Shane Huntley said that the attacks were targeted" and not related to the U.S. election.
A Microsoft spokesperson also added that the reported attack is very limited and targeted in nature, and we have seen no evidence to indicate widespread usage."
It's the latest in a list of major flaws affecting Windows this year. Microsoft said in January that the National Security Agency helped find a cryptographic bug in Windows 10, though there was no evidence of exploitation. But in June and September, Homeland Security issued alerts over two critical" Windows bugs - one which had the ability to spread across the internet, and the other could have gained complete access to an entire Windows network.
Updated with comment from Microsoft.
Homeland Security issues rare emergency alert over critical' Windows bug