CVE-2020-9331: High severity cryptopro csp vulnerability
CryptoPro CSP through 5.0.0.10004 on 32-bit platforms allows Local Privilege Escalation (by local users with the SeChangeNotifyPrivilege right) because user-mode input is mishandled during process creation. An attacker can write arbitrary data to an arbitrary location in the kernel's address space.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-9331?
CVE-2020-9331 is classified as a Local Privilege Escalation vulnerability.
How do I fix CVE-2020-9331?
To fix CVE-2020-9331, update CryptoPro CSP to a version greater than 5.0.0.10004.
Who is affected by CVE-2020-9331?
Users of CryptoPro CSP versions up to 5.0.0.10004 on 32-bit platforms are affected by CVE-2020-9331.
What can an attacker do with CVE-2020-9331?
An attacker can exploit CVE-2020-9331 to write arbitrary data to a location in the kernel's address space, leading to privilege escalation.
What privilege is required to exploit CVE-2020-9331?
Exploitation of CVE-2020-9331 requires the attacker to have the SeChangeNotifyPrivilege right.