CVE-2020-0878Microsoft Edge and Internet Explorer Memory Corruption Vulnerability

What it is

Code writes past the end of a buffer, corrupting memory in ways an attacker can often turn into code execution.

How it is reached

An attacker can exploit it over the network, without an account, but someone has to act first, such as opening a file or following a link. Success also depends on conditions the attacker does not fully control.

What an attacker gains

The direct impact is limited: partial access to data or a partial outage. In practice, this kind of flaw lets an attacker crash the process, read memory, or in the worst case run code.

Is it being exploited?

CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03: it is being exploited in the wild. CISA links it to ransomware campaigns. EPSS estimates a 2.7% chance of exploitation activity in the next 30 days, higher than 86% of scored CVEs.

What to do

1. Treat it as urgent: it is on CISA's KEV list. CISA's deadline for US federal agencies: 2022-05-03.
2. Apply the fix for Microsoft Edge and Internet Explorer: the patch and release notes are linked below.
3. Until it is patched, keep it off the internet or behind a VPN, allowlist or authenticating proxy.
4. Warn the people who use it, and filter files and links on the way in.
5. Check exposed instances for signs of compromise, not only for the version.

Description from NVD

<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers, and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically via an enticement in email or instant message, or by getting them to open an email attachment.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory.</p>