CVE-2020-0558: Intel PROSet/Wireless WiFi DoS Vulnerability

CVE-2020-0558 Overview

CVE-2020-0558 is a medium-severity vulnerability affecting the kernel mode driver for Intel PROSet/Wireless WiFi products on Windows 10 systems. The vulnerability stems from improper buffer restrictions within the driver, which may allow an unprivileged user on an adjacent network to potentially cause a denial of service condition. This vulnerability affects a wide range of Intel wireless adapters and requires the attacker to be within adjacent network proximity to exploit.

Critical Impact

An unprivileged attacker on an adjacent network can exploit improper buffer restrictions in the Intel wireless kernel driver to cause denial of service, disrupting wireless connectivity for affected Windows 10 systems.

Affected Products

• Intel PROSet/Wireless WiFi (versions before 21.70)
• Intel Wi-Fi 6 AX200
• Intel Wi-Fi 6 AX201
• Intel Wireless-AC 9260
• Intel Wireless-AC 9461
• Intel Wireless-AC 9462
• Intel Wireless-AC 9560
• Intel Dual Band Wireless-AC 8260
• Intel Dual Band Wireless-AC 8265
• Intel Dual Band Wireless-AC 3165
• Intel Dual Band Wireless-AC 3168
• Intel Dual Band Wireless-AC 7265 (Rev D)

Discovery Timeline

• April 15, 2020 - CVE-2020-0558 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-0558

Vulnerability Analysis

This vulnerability exists within the kernel mode driver component of Intel's PROSet/Wireless WiFi software suite for Windows 10. The flaw involves improper buffer restrictions, a type of input validation error where the driver fails to properly constrain buffer operations. When exploited, this can lead to memory corruption or resource exhaustion conditions that result in denial of service.

The vulnerability requires adjacent network access, meaning an attacker must be within wireless range or on the same local network segment as the target system. No authentication or user interaction is required for exploitation. While the vulnerability does not compromise confidentiality or integrity, it can cause complete disruption of wireless functionality through high availability impact.

Root Cause

The root cause of CVE-2020-0558 lies in insufficient boundary validation within the kernel mode driver's buffer handling routines. The driver fails to properly enforce restrictions on buffer operations, allowing specially crafted input from an adjacent network to trigger abnormal driver behavior. Since the vulnerable code executes in kernel mode, exploitation can cause system-level disruption including potential system crashes or wireless adapter unavailability.

Attack Vector

The attack requires the adversary to be positioned on an adjacent network—typically within wireless range of the target or on the same physical network segment. From this position, the attacker can send malformed wireless frames or network packets that trigger the improper buffer handling in the kernel driver.

The vulnerability mechanism involves sending specially crafted data that exploits the buffer restriction weakness in Intel's wireless driver. When the driver processes this malicious input without proper validation, it can lead to memory corruption, resource exhaustion, or driver crashes that manifest as denial of service. The technical details of the exploitation involve malformed wireless management frames or data frames that target specific parsing routines in the kernel driver. For complete technical details, refer to the Intel Security Advisory SA-00338.

Detection Methods for CVE-2020-0558

Indicators of Compromise

• Unexpected wireless adapter disconnections or failures on Windows 10 systems with Intel wireless hardware
• Blue Screen of Death (BSOD) events referencing Intel wireless driver components
• System event logs showing kernel driver crashes or errors related to Intel PROSet/Wireless WiFi drivers
• Repeated wireless connectivity issues occurring when unfamiliar devices are in proximity

Detection Strategies

• Monitor Windows Event Logs for driver crash events involving Netwtw04.sys, Netwtw06.sys, or other Intel wireless kernel drivers
• Implement wireless intrusion detection systems (WIDS) to identify malformed wireless frames
• Configure endpoint detection tools to alert on repeated wireless driver failures or system instability patterns
• Deploy SentinelOne Singularity to detect anomalous kernel driver behavior and potential exploitation attempts

Monitoring Recommendations

• Enable detailed logging for wireless adapter events and driver crashes on Windows 10 endpoints
• Monitor for patterns of wireless denial of service affecting multiple systems simultaneously
• Track Intel wireless driver versions across the fleet to identify unpatched systems running versions prior to 21.70
• Implement network-level monitoring to detect suspicious wireless traffic patterns near enterprise access points

How to Mitigate CVE-2020-0558

Immediate Actions Required

• Update Intel PROSet/Wireless WiFi drivers to version 21.70 or later immediately on all affected Windows 10 systems
• Audit all systems with Intel wireless adapters to identify vulnerable driver versions
• Consider temporarily disabling wireless connectivity on critical systems until patches can be applied
• Implement network segmentation to limit adjacent network access where possible

Patch Information

Intel has released patched drivers addressing this vulnerability in Intel PROSet/Wireless WiFi version 21.70 and later. Organizations should download the latest drivers from the official Intel Download Center or through Windows Update. The security advisory with complete details is available at Intel Security Advisory SA-00338.

System administrators should prioritize updating all systems with affected Intel wireless hardware, including laptops and workstations using Wi-Fi 6 AX200/AX201, Wireless-AC 9xxx series, and Dual Band Wireless-AC adapters.

Workarounds

• Use wired Ethernet connections instead of wireless where feasible until patches are applied
• Implement MAC address filtering and strong wireless security (WPA3) to limit unauthorized adjacent network access
• Deploy wireless intrusion prevention systems (WIPS) to block malformed wireless frames
• Restrict physical access to wireless coverage areas to reduce the attack surface for adjacent network exploitation

# Check Intel wireless driver version on Windows systems
wmic path win32_pnpsigneddriver where "DeviceName like '%Intel%Wireless%'" get DeviceName,DriverVersion

# Example expected output for patched version:
# DeviceName                              DriverVersion
# Intel(R) Wi-Fi 6 AX201 160MHz           21.70.0.6