Actively exploited · Published Mar 17, 2017 · Assigned by microsoft
CVE-2017-0101
High 7.8 Exploited Ransomware
In plain English
A high-severity memory corruption in Windows from Microsoft Corporation. Attackers are actively exploiting it in the wild (listed by CISA on March 15, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 57.5% (higher than 99.1% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 5, 2022.
Official description
The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft Corporation | Windows | The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607 |
Weakness: CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- 44479 exploit, x_refsource_EXPLOIT-DB
- 96625 vdb-entry, x_refsource_BID
- 1038013 vdb-entry, x_refsource_SECTRACK
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0101 x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0101 government-resource