Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-8564 — Sensitive Information Exposure in Microsoft Windows 10

CWE-200 — Sensitive Information Exposure5 documents5 sources
Severity
5.5MEDIUMNVD
EPSS
22.9%
top 4.09%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
15
Microsoft Windows 10Microsoft Windows Server 2008Microsoft Windows Server 2012+12 more
Timeline
PublishedJul 11
Latest updateMay 14

Description

Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly initialize a memory address, aka "Windows Kernel Information Disclosure Vulnerability".

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages14 packages

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-2697-5v76-cfvp: Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8↗2022-05-14
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows Kernel - 'IOCTL 0x120007 NsiGetParameter' nsiproxy/netio Pool Memory Disclosure↗2017-07-18
▶

📋Vendor Advisories

1
Microsoft
Windows Kernel Information Disclosure Vulnerability↗2017-07-11
▶

🕵️Threat Intelligence

1
Talos
Microsoft Patch Tuesday - July 2017↗2017-07-11
▶