Microsoft Windows SMBv1 Remote Information Disclosure Vulnerability (CVE-2017-0147) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability exists in the Microsoft Windows SMBv1 (Server Message Block v1) server engine (srv.sys). The root cause is a failure of the SMBv1 server to properly validate the length and boundaries of transaction requests sent by a client. This lack of validation allows an attacker to request more data than the buffer actually contains, leading to an out-of-bounds read that leaks kernel memory space back to the requester.

2. Exploitation Mechanics & Attack Scenario

An attacker initiates the exploit by establishing an anonymous SMB connection over TCP port 445 and sending a specially crafted SMBv1 transaction request. Because the server does not validate the requested buffer size against the actual transaction data size, it copies adjacent kernel memory into the response packet. This leaked memory can contain sensitive data such as session tokens, cryptographic keys, or internal memory addresses. This specific information disclosure mechanism was heavily utilized by the 'DOUBLEPULSAR' implant to verify successful installation and bypass exploit mitigations like ASLR.

3. Infrastructure & Business Impact

Classified under CISA's Known Exploited Vulnerabilities (KEV) catalog with an EPSS score of 0.9969, this vulnerability represents an active and severe threat. If exploited, it allows attackers to perform reconnaissance within the internal network, harvest credentials from memory, and facilitate lateral movement. This can lead to full domain compromise, ransomware deployment, and catastrophic business disruption.