CVE-2020-36603 : Security Advisory and Response
Learn about CVE-2020-36603, a critical vulnerability in Genshin Impact's mhyprot2.sys driver that allows unauthorized users to execute code with SYSTEM privileges on Windows systems. Find mitigation steps and preventive measures here.
A vulnerability in the mhyprot2.sys anti-cheat driver used by HoYoVerse's Genshin Impact allows local unprivileged users to execute arbitrary code with SYSTEM privileges on Windows systems.
Understanding CVE-2020-36603
The mhyprot2.sys driver lacks proper restrictions on unprivileged function calls, leading to a critical security issue.
What is CVE-2020-36603?
The vulnerability in the mhyprot2.sys driver of Genshin Impact enables unauthorized users to run code with elevated privileges on Windows.
The Impact of CVE-2020-36603
The security flaw allows attackers to execute malicious code with SYSTEM-level permissions, posing a significant risk to affected systems.
Technical Details of CVE-2020-36603
The technical aspects of the vulnerability provide insights into its nature and potential exploitation.
Vulnerability Description
The mhyprot2.sys driver in Genshin Impact fails to adequately restrict unprivileged function calls, enabling unauthorized users to escalate privileges and execute arbitrary code.
Affected Systems and Versions
- Product: Not applicable
- Vendor: Not applicable
- Versions: mhyprot2.sys 1.0.0.0
Exploitation Mechanism
Attackers with local access can leverage the vulnerability to execute arbitrary code with elevated privileges, compromising the integrity of Windows systems.
Mitigation and Prevention
Addressing CVE-2020-36603 requires immediate actions and long-term security measures.
Immediate Steps to Take
- Disable or remove the mhyprot2.sys driver if not essential for system operation.
- Monitor system logs for any suspicious activities or privilege escalations.
- Implement the principle of least privilege to restrict user access rights.
Long-Term Security Practices
- Regularly update and patch the system to mitigate known vulnerabilities.
- Conduct security audits and penetration testing to identify and address potential weaknesses.
Patching and Updates
- Apply patches or updates provided by the vendor to fix the vulnerability in the mhyprot2.sys driver.