CVE-2017-0148

CVE-2017-0148: Windows SMBv1 Remote Code Execution (EternalBlue Family)

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2017-0148 is a remote code execution vulnerability in the SMBv1 server implementation shipped with Windows. An unauthenticated attacker can send specially crafted packets to a target system's SMBv1 service to achieve full arbitrary code execution with SYSTEM-level privileges. This flaw is part of the same vulnerability cluster as the EternalBlue exploit chain (CVE-2017-0143 through CVE-2017-0146) disclosed in the March 2017 Microsoft security update cycle and later weaponized by threat actors globally.

Background

Server Message Block version 1 (SMBv1) is a legacy network file-sharing protocol that has been present in Windows since the early 1990s. Despite the availability of more secure successors (SMBv2 and SMBv3), SMBv1 remained enabled by default on many Windows editions for backward compatibility. In early 2017, the Shadow Brokers leak exposed a set of Equation Group exploits, including EternalBlue, which targeted this exact SMBv1 attack surface. CVE-2017-0148 represents a related but distinct RCE path within the same SMBv1 handling code.

Root Cause

CWE-20: Improper Input Validation.

The SMBv1 server fails to properly validate the size and structure of incoming SMB packets before processing them. Specifically, crafted packets can trigger memory corruption conditions—such as buffer mishandling or integer issues—within the kernel-mode SMB driver (srv.sys). Because the parser operates in kernel space and does not adequately sanitize length fields or packet boundaries, malformed input propagates into memory operations that the attacker can steer toward arbitrary code execution. The vulnerability is exploitable without any prior authentication.

Impact

An successful exploit grants the attacker full control over the target system: read/write access to all files, ability to install persistent malware, lateral movement across the network, and encryption of data for ransom. The combination of network reachability, no credential requirement, and complete impact makes this vulnerability exceptionally severe. Its real-world impact was demonstrated at scale by the WannaCry (May 2017) and NotPetya (June 2017) campaigns.

Exploitation Walkthrough

Ethics caveat: This section describes the attack mechanics from a defensive and research perspective only. It does not contain weaponized exploit code, nor step-by-step instructions that would enable unauthorized access to systems. All information is derived from publicly available vendor advisories, NVD data, and verified research publications.

1. Reconnaissance: The attacker identifies a reachable host with TCP port 445 open, indicating an active SMB service.
2. Protocol negotiation: The attacker initiates an SMBv1 session. If the server responds with SMBv1 dialect support, the target is potentially vulnerable.
3. Malformed packet delivery: The attacker sends one or more crafted SMB packets containing abnormal length fields or out-of-bounds offsets. These packets are designed to corrupt memory structures inside the SMB driver's packet-handling routines.
4. Payload execution: By controlling the corrupted memory layout, the attacker redirects execution to shellcode of their choosing, typically achieving kernel-level or SYSTEM privileges without user interaction.

From a defender's perspective, the absence of authentication requirements and the ability to deliver the exploit as a single network packet make this attack extremely efficient for automated worms.

Affected and Patched Versions

Microsoft Windows

Siemens Medical Devices

Multiple Siemens imaging and laboratory systems were also identified as vulnerable because they run embedded Windows variants with SMBv1 exposed. Affected product lines include Acuson P300, P500, SC2000, X700, and others. Siemens issued product-specific security advisories (SSA-701903, SSA-966341) with patch and mitigation guidance.

Patch status: Microsoft released security updates in MS17-010 (March 2017) that addressed this vulnerability. Systems patched with MS17-010 or later cumulative updates are protected.

Remediation

1. Apply patches immediately. Install Microsoft security update MS17-010 or any subsequent cumulative update for your Windows version.
2. Disable SMBv1. Unless explicitly required by a legacy application, disable the SMBv1 protocol via PowerShell (Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol) or Group Policy. SMBv1 is deprecated and should not be used in modern environments.
3. Network segmentation. Restrict SMB traffic (TCP 445) to trusted internal network segments. Block inbound SMB at the perimeter firewall.
4. Compensating controls. If patching is temporarily impossible, deploy the Microsoft SMBv1 disable workaround and ensure endpoint protection products have signatures for EternalBlue/DOUBLEPULSAR traffic patterns.

Detection

• Network: Monitor for anomalous SMBv1 dialect negotiation from unexpected sources. IDS/IPS rules for EternalBlue/DOUBLEPULSAR shellcode patterns are widely available.
• Host: Look for abnormal srv.sys crash events, unexpected processes spawning from System or svchost.exe, and unauthorized file modifications.
• Behavioral: WannaCry and NotPetya both exhibited distinctive lateral-movement behavior over SMB; modern EDR platforms flag these patterns.
• Vulnerability scanning: Confirm whether TCP/445 responds with SMBv1; if so, the system may be unpatched.

Assessment

With an EPSS score of 99.373%, CVE-2017-0148 sits in the top 0.1% of all CVEs by probability of active exploitation. Its inclusion in CISA's Known Exploited Vulnerabilities catalog (since April 2022) and the EU Vulnerability Database confirms sustained threat-actor interest. The vulnerability's role in two of the most destructive ransomware worms in history makes it a canonical example of how a single unpatched network service can cascade into global damage.

Key lessons:

1. Disable legacy protocols before they are weaponized. SMBv1 was obsolete long before 2017; leaving it enabled expanded the attack surface for the entire Windows ecosystem.
2. Patch velocity matters. The WannaCry outbreak occurred more than a month after MS17-010 was released. Organizations with disciplined patch cycles avoided compromise entirely.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0148
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0148
• https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
• http://www.securityfocus.com/bid/96706
• http://www.securitytracker.com/id/1037991
• https://www.exploit-db.com/exploits/41891/
• https://www.exploit-db.com/exploits/41987/
• http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html
• http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html