Windows 10 is the victim of a security breach that will...

Discovered on October 22, a 0-day Windows 10 flaw has not yet been fixed. And even if the flaw is currently exploited, it will not be corrected until November 10, 2020, when Microsoft will deploy its traditional Patch Tuesday.

Project Zero, a team of cybersecurity specialists put together by Google, recently highlighted an o-day flaw concerning Windows 10. The vulnerability is called CVE-2020-17087 and causes a Windows kernel buffer overflow.

So far, nothing abnormal, the Microsoft operating system regularly being the subject of vulnerabilities of all kinds. But Microsoft was slow to fix it, the source code was released and hackers are already at work to take advantage of it.

Read also: Windows 10, the October 2020 patch Tuesday fixes 87 security flaws, including a very dangerous one

Microsoft is slow to fix Windows 10 flaw CVE-2020-17087

According to the Google team, a bug residing in the cng function! CfgAdtpFormatPropertyBlock and regarding the Windows Kernel Cryptography driver (cng.sys) can cause a 16-bit integer truncation problem. Carrying the identifier CVE-2020-17087, this bug was revealed on October 22, but has still not been corrected by Microsoft. Once the flaw has been exploited, a hacker is then able to cause machine crashes, which can be annoying, but does not in itself cause any security problem. On the other hand, he also has the possibility to elevate his privileges, which turns out to be much more problematic since he then has the means to take control of the PC.

According to Google, it seems that hackers were already exploiting this security flaw before its discovery by the Project team: Google therefore granted Microsoft 7 days to address the vulnerability, after which Project Zero published its source code. This is not the first time that Google has given Microsoft a very short deadline to patch its operating system. In 2018, a vulnerability revealed in Windows 10 S had even forced the editor of Redmond to release a patch in disaster on its site.

There is therefore an emergency now. Note however that the vulnerability in question can only be exploited locally and not remotely. What strongly limit its scope. On the other hand, if the source code has been tested successfully on Windows 10 version 1903, according to the Project Zero team, this flaw could also affect Windows 7 and Windows 8.1. At present, therefore, there is no way to close this security hole. Also according to Project Zero, Microsoft is working on a fix, but it will not be released until the next Patch Tuesday, which is scheduled for the November 10.