CVE-2020-0835: Windows Defender Privilege Escalation Flaw

CVE-2020-0835 Overview

CVE-2020-0835 is an elevation of privilege vulnerability that exists when the Windows Defender antimalware platform improperly handles hard links. This vulnerability allows a local attacker with low privileges to escalate their privileges on affected systems by exploiting the flawed hard link processing mechanism within Microsoft's built-in security solution.

Critical Impact

Local attackers can leverage improper hard link handling in Windows Defender to elevate privileges, potentially gaining complete control over affected Windows systems where Defender is active.

Affected Products

• Microsoft Windows Defender (all versions prior to patch)

Discovery Timeline

• 2020-04-15 - CVE-2020-0835 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-0835

Vulnerability Analysis

This vulnerability stems from how Windows Defender's antimalware platform processes hard links during file system operations. When Windows Defender performs scanning or remediation actions, it interacts with the file system in ways that can be manipulated by attackers who understand the underlying hard link mechanics.

Hard links in Windows create additional directory entries that point to the same underlying file data. When Windows Defender operates on files—such as during quarantine operations, file scanning, or threat removal—it may follow hard links without properly validating the target destination. An attacker can craft malicious hard links that redirect Defender's privileged operations to target arbitrary files on the system.

The attack requires local access and low-level privileges initially, but successful exploitation results in complete compromise of confidentiality, integrity, and availability on the affected system. The vulnerability does not require user interaction to exploit once an attacker has local access.

Root Cause

The root cause of CVE-2020-0835 lies in insufficient validation of file system objects during privileged operations performed by the Windows Defender antimalware engine. Specifically, the antimalware platform fails to properly verify the true target of hard links before performing security-sensitive file operations. This allows attackers to redirect privileged write or delete operations to arbitrary system files by creating hard links that point to protected locations while appearing as legitimate targets to Defender's processing routines.

Attack Vector

The attack vector for CVE-2020-0835 is local, requiring an attacker to have existing access to the target system with low-level user privileges. The exploitation technique involves creating hard links in locations where Windows Defender performs privileged file operations. When Defender processes these crafted hard links—for example, during a scan or when moving files to quarantine—the operation is inadvertently redirected to the attacker-specified target.

A successful attack could enable an attacker to overwrite or delete critical system files, modify security configurations, or escalate privileges to SYSTEM level by manipulating files associated with privileged services. The attack complexity is low, and no user interaction is required beyond the attacker's initial actions to set up the hard link.

The vulnerability is particularly concerning because it targets Windows Defender itself—a security component that runs with elevated privileges specifically to protect the system. By exploiting this flaw, attackers can weaponize the security solution against the system it's designed to protect.

Detection Methods for CVE-2020-0835

Indicators of Compromise

• Unusual hard link creation events in Windows file system audit logs, particularly targeting Windows Defender directories
• Unexpected file modifications in protected system directories coinciding with Windows Defender activity
• Anomalous Windows Defender process behavior, including operations on files outside normal scan targets
• Event logs showing privilege escalation attempts or unauthorized access to system files following Defender operations

Detection Strategies

• Enable Windows file system auditing to monitor hard link creation and modification events
• Monitor Windows Defender operational logs for unusual file system operations or errors during quarantine/remediation actions
• Deploy endpoint detection solutions capable of identifying suspicious hard link abuse patterns
• Implement behavioral analysis to detect privilege escalation attempts following file system manipulation

Monitoring Recommendations

• Configure Windows Security Event logging to capture file system object creation (Event ID 4663) with specific attention to hard link operations
• Monitor the MsMpEng.exe process for unusual file access patterns or operations on unexpected file paths
• Establish baseline behavior for Windows Defender file operations and alert on deviations
• Implement real-time monitoring of system integrity for critical Windows files and directories

How to Mitigate CVE-2020-0835

Immediate Actions Required

• Apply the Microsoft security update addressing CVE-2020-0835 immediately
• Verify Windows Defender antimalware platform version is updated to the patched release
• Review systems for signs of exploitation or unauthorized privilege escalation
• Restrict local access to systems where possible to reduce the attack surface

Patch Information

Microsoft has released a security update to address this vulnerability. Administrators should consult the Microsoft Security Advisory for CVE-2020-0835 for detailed patch information and deployment guidance. Windows Defender typically updates automatically through Windows Update, but organizations should verify that the patched antimalware platform version has been deployed across their environment.

Workarounds

• Implement strict local access controls to limit which users can create hard links on the system
• Enable Windows Defender Application Control or similar application whitelisting to restrict unauthorized executables
• Monitor and restrict hard link creation in sensitive directories through Windows Group Policy
• Consider using filesystem integrity monitoring tools to detect unauthorized hard link creation

# Verify Windows Defender platform version (PowerShell)
Get-MpComputerStatus | Select-Object AMProductVersion, AMEngineVersion, AntispywareSignatureVersion

# Force Windows Defender update
Update-MpSignature

# Check Windows Defender service status
Get-Service WinDefend | Select-Object Status, StartType