CVE-2017-0005
Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability
Description
CVE-2017-0005 is a privilege escalation vulnerability in the Graphics Device Interface (GDI) component of Microsoft Windows. The flaw allows local users to gain elevated system privileges through a specially crafted application that exploits improper memory handling in the GDI subsystem. An attacker who successfully exploits this vulnerability could execute arbitrary code with SYSTEM-level privileges, gaining full control over the affected Windows system. CVE-2017-0005 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and its EPSS percentile of 92.0% indicates a high likelihood of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1511 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows vista | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/96033(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038002(Broken Link, Third Party Advisory, VDB Entry)
- https://blogs.technet.microsoft.com/mmpc/2017/03/27/detecting-and-mitigating-elevation-of-privilege-exploit-for-cve-2017-0005/(Exploit, Mitigation, Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0005(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0005(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119 describes weaknesses where a product performs operations on a memory buffer without properly restricting those operations to the intended boundaries. In CVE-2017-0005, the Windows GDI component fails to properly handle objects in memory, allowing a crafted application to perform out-of-bounds operations that lead to privilege escalation from a standard user context to SYSTEM-level access.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2017-0005 enables local privilege escalation, allowing an attacker with standard user access to elevate to SYSTEM-level privileges on affected Windows systems. The vulnerability requires local access and the ability to execute a crafted application, but no user interaction beyond the initial execution is needed. Once exploited, the attacker gains complete control over confidentiality, integrity, and availability of the system, as SYSTEM privileges permit unrestricted access to all files, processes, and system configurations. The EPSS percentile of 92.0% reflects significant exploitation activity. This vulnerability was notably attributed to a threat actor group and was used as part of targeted attack campaigns against organizations, where initial access was achieved through other means (such as phishing) and CVE-2017-0005 was then used for local privilege escalation to advance the attack chain.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2017-0005 and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 14, 2022. The EPSS percentile of 92.0% indicates a high probability of exploitation. This vulnerability was attributed to a sophisticated threat actor group (reported as linked to the Zirconium/APT31 group) and was used in targeted attacks before the patch was available, making it a former zero-day. The targeted nature of its exploitation means it was primarily used in advanced persistent threat (APT) campaigns rather than mass exploitation, though the public availability of patch details after the fix increases the risk of broader exploitation of remaining unpatched systems.
Remediation
- Apply Microsoft security updates as specified by the vendor. CISA's KEV catalog requires organizations to apply updates per vendor instructions for CVE-2017-0005.
- Prioritize patching Windows systems where the GDI component is exposed, particularly workstations and servers in environments targeted by advanced persistent threats.
- Implement application whitelisting or application control policies to prevent the execution of unauthorized applications that could be used to exploit this privilege escalation vulnerability.
- Apply the principle of least privilege across the environment, ensuring that users operate with standard accounts rather than administrative accounts to limit the impact of successful exploitation.
- Monitor for suspicious process execution patterns, particularly unexpected GDI-related activity or attempts to spawn elevated processes from standard user contexts, using endpoint detection and response (EDR) tools.
Technical Details
CVE-2017-0005 is a memory corruption vulnerability in the Windows Graphics Device Interface (GDI) that leads to local privilege escalation. The GDI subsystem improperly handles objects in memory, which falls under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). When a locally executed crafted application triggers the vulnerable code path, the GDI component performs out-of-bounds memory operations that allow the attacker to execute arbitrary code with elevated SYSTEM privileges. The attack vector is local, requiring the attacker to first gain code execution on the target system, but the exploitation complexity is low once local access is achieved. This vulnerability was particularly notable for being used as a zero-day by an advanced threat actor, where it served as the privilege escalation component in multi-stage attack chains that began with remote access via spearphishing or watering hole attacks.
Frequently Asked Questions
Is CVE-2017-0005 being actively exploited?
Yes, CVE-2017-0005 has been actively exploited in targeted attacks. CISA has confirmed active exploitation and added it to the KEV catalog. The vulnerability was used as a zero-day by a sophisticated threat actor group before the patch was released. The EPSS percentile of 92.0% reflects high exploitation probability.
What products are affected by CVE-2017-0005?
CVE-2017-0005 affects the Graphics Device Interface (GDI) component in Microsoft Windows. Multiple versions of Windows are affected, including Windows Vista, Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2012, and Windows Server 2016.
How do I fix CVE-2017-0005?
Apply the relevant Microsoft security updates as directed by the vendor. Additionally, implement application whitelisting policies and the principle of least privilege to reduce the attack surface. See the Remediation section for detailed steps.
How severe is CVE-2017-0005?
CVE-2017-0005 is a privilege escalation vulnerability that allows local attackers to gain SYSTEM-level access. Its EPSS percentile of 92.0% indicates high exploitation probability. While the attack requires local access, its use as a zero-day in APT campaigns demonstrates its value in advanced attack chains targeting organizations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.