Microsoft Windows SMBv3 Remote Code Execution and Privilege Escalation Vulnerability (SMBGhost, CVE-2020-0796) Technical Advisory

1. Vulnerability Overview & Root Cause

This vulnerability, widely known as 'SMBGhost', is a buffer overflow vulnerability (CWE-119) residing in the way Microsoft Server Message Block 3.1.1 (SMBv3) handles compressed data packets. When an SMBv3 client or server decompresses a network packet, an integer overflow occurs during the calculation of the decompressed buffer size. This leads to an out-of-bounds write, allowing arbitrary data to overwrite adjacent kernel memory spaces.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted packet containing a malicious compression header to a target SMBv3 server listening on TCP port 445. The decompression routine in the srv2.sys driver processes this packet, triggering the buffer overflow in kernel space. Because this occurs during the pre-authentication phase, no valid credentials are required. Attackers can leverage this to achieve Remote Code Execution (RCE) or execute Local Privilege Escalation (LPE) payloads. The flaw is highly critical due to its 'wormable' nature, allowing lateral movement without user interaction.

3. Infrastructure & Business Impact

With a CVSS score of 10.0 and active exploitation confirmed via its inclusion in the CISA KEV catalog, SMBGhost poses an extreme risk to enterprise environments. A single compromised host can serve as a beachhead for attackers to rapidly propagate malware, such as ransomware, across the entire internal network. This can lead to complete domain compromise, massive data exfiltration, and catastrophic operational downtime.