⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-04-05.

CVE-2017-0101 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Corporation Windows

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents7 sources
Severity
7.8HIGHNVD
EPSS
67.2%
top 1.43%
CISA KEV
KEVRansomware
Added 2022-03-15
Due 2022-04-05
Exploit
Exploited in wild
Active exploitation observed
Affected products
7
Microsoft Corporation WindowsMsrc Windows 7 FOR 32-bit Systems Service Pack 1Msrc Windows Server 2008 FOR 32-bit Systems Service Pack 2+4 more
Timeline
PublishedMar 17
KEV addedMar 15
KEV dueApr 5
Latest updateMay 14
CISA Required Action: Apply updates per vendor instructions.

Description

The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5microsoft_corporation/windowsThe kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-5cr3-r8pg-5j63: The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8↗2022-05-14
▶
VulnCheck
Microsoft Windows Transaction Manager Privilege Escalation Vulnerability↗2017
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows Kernel (7 x86) - Local Privilege Escalation (MS17-017)↗2018-03-15
▶

📋Vendor Advisories

2
CISA
Microsoft Windows Transaction Manager Privilege Escalation Vulnerability↗2022-03-15
▶
Microsoft
Windows Transaction Manager Elevation of Privilege Vulnerability↗2017-03-14
▶

🕵️Threat Intelligence

1
Tenable
ContiLeaks: Chats Reveal Over 30 Vulnerabilities Used by Conti Ransomware – How Tenable Can Help↗2022-03-24
▶
CVE-2017-0101 — Corporation Windows vulnerability | cvebase