CVE-2020-1138: Windows Storage Service Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service Elevation of Privilege Vulnerability'.
Other sources
An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges on the victim system. To exploit the vulnerability, an attacker would first have to gain execution on the victim system, then run a specially crafted application. The security update addresses the vulnerability by correcting how the Storage Services handles file operations.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556799 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556807 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556813 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4556812 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch KB4551853
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must first gain execution on the target system and be able to run a specially crafted application. The CVSS vector indicates local access and low privileges are required; no user interaction is required.
What is the potential impact after successful exploitation?
A successful attacker could gain elevated privileges on the victim system. The listed CVSS impacts indicate high potential impact to confidentiality, integrity, and availability.
Which systems are identified as affected?
The affected software listed is Microsoft Windows 10, Microsoft Windows Server 2016, Microsoft Windows Server 2019, and Microsoft Windows Server.
What remediates the issue?
The security update remediates the vulnerability by correcting how the Storage Service handles file operations.