CVE-2017-0005
Published: 17 March 2017
Summary
CVE-2017-0005 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 5.8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability is an elevation of privilege flaw in the Graphics Device Interface (GDI) component of Microsoft Windows. It affects Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607. The issue permits local users to gain additional privileges through a crafted application and is distinct from the related GDI issues tracked as CVE-2017-0001, CVE-2017-0025, and CVE-2017-0047.
An attacker with the ability to run a malicious application on an affected system (low privileges, no user interaction required) can exploit the flaw to achieve full elevation of privilege, resulting in high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score of 7.8 reflects the local attack vector and low complexity.
Microsoft has published security guidance and an advisory for CVE-2017-0005, along with guidance on detecting and mitigating exploitation attempts.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2017-0372
Vulnerability details
The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local…
more
users to gain privileges via a crafted application, aka "Windows GDI Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0001, CVE-2017-0025, and CVE-2017-0047.
- CWE(s)
- KEV Date Added
- 24 May 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of Microsoft patches that eliminate the GDI EoP flaw before a crafted local application can exploit it.
Enforces least-privilege execution so a low-privileged process cannot abuse the GDI vulnerability to obtain higher rights.
Malicious-code protection mechanisms can block or alert on the crafted application used to trigger the GDI flaw.