# CVE-2020-17087: Windows pool buffer overflow in cng.sys IOCTL

16-bit truncation in cng.sys CfgAdtpFormatPropertyBlock IOCTL 0x390400 under-allocates pool buffer, enabling kernel overflow and sandbox escape.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Windows
- Credited: Mateusz Jurczyk, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2021-02-04)
- Disclosed: 2020-10-30
- CVE: CVE-2020-17087
- Write-up quality: 7/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2020/CVE-2020-17087.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2020-17087
- Tags: impact:privesc impact:rce kind:incident platform:project-zero sev:high technique:chained technique:source-review vuln:memory-corruption

**Target:** cng.sys kernel driver IOCTL 0x390400
**Root cause:** CfgAdtpFormatPropertyBlock multiplies an attacker-controlled length by 6 and stores it in a USHORT, truncating the allocation size; input length >= 0x2AAB makes BCryptAlloc allocate too small a pool buffer.
**Steps:**
1. Open handle to cng.sys device and issue IOCTL `0x390400`
2. Pass input buffer length >= `0x2AAB` so length*6 truncates in USHORT
3. BCryptAlloc allocates undersized pool buffer
4. Copy of property data overflows the pool allocation
**How found:** Text suggests either manual audit of user-reachable IOCTL handling code or coverage-guided fuzzing; no explicit reasoning trail given.
**Exploitation:** Chained with CVE-2020-15999 in a Chrome exploit; the pool overflow was used to build an arbitrary read/write primitive in kernel address space via Named Pipe objects, breaking the Chrome sandbox and achieving SYSTEM code execution.
**Escalation:** Sandbox escape from Chrome renderer to kernel/system privileges by pairing with a Chrome font bug (CVE-2020-15999).
**Insight:** Hunt for allocation-size computations stored in undersized integer types (USHORT/16-bit) in user-reachable kernel IOCTLs; lengths just above truncation boundaries like 0x2AAB are the sweet spot.