Microsoft Windows LPE: Nightmare Eclipse Resurfaces Old CVE-2020-17103 Flaw

Security researcher Nightmare Eclipse claims Microsoft has failed to adequately patch CVE-2020-17103, a vulnerability originally reported by James Forshaw of Google Project Zero in 2020. According to LΣҒΔ𝕽ΩLL 🇮🇱, Nightmare Eclipse asserts that after re-examining the affected code area within cldflt.sys, the Local Privilege Escalation (LPE) issue persists. This suggests either the original patch was incomplete or the flaw was inadvertently reintroduced.

Nightmare Eclipse has reportedly published a Proof-of-Concept (PoC) on GitHub that achieves SYSTEM-level privileges on Windows. LΣҒΔ𝕽ΩLL 🇮🇱 emphasizes that this is not a zero-day but rather a resurfaced vulnerability from years ago, highlighting a potential oversight in Microsoft’s patching process. It underscores that even with significant resources, patching can be flawed, leaving systems exposed to previously identified weaknesses.

This LPE requires an attacker to already have access to the machine, meaning it’s not an internet-facing exploit. However, it’s a critical post-exploitation capability. An attacker who gains an initial foothold can leverage this to gain full control, bypass security controls, and deploy further malware or persist on the network. Defenders cannot dismiss LPEs; they are often the final step in a successful breach.