CVE-2017-0101

CVE-2017-0101 is an elevation-of-privilege vulnerability (CWE-119, memory-handling class) in the kernel-mode drivers of the Windows Transaction Manager, affecting Windows Vista SP2 through Windows Server 2016. It is triggered when a local user runs a crafted application on an affected system, allowing them to exploit the flaw and escalate privileges. Successful exploitation yields SYSTEM/administrator-level access on the local machine, which attackers commonly chain as a pre-encryption step in ransomware campaigns. All releases listed in the advisory are affected: Windows Vista SP2, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows 10 RTM/1511/1607, and Windows Server 2008 SP2/R2, Server 2012/R2, and Server 2016 — most of which are now end-of-support. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2022-03-15 with known ransomware use, EPSS assigns a 57.5% probability of exploitation within 30 days (99th percentile), and a public proof-of-concept is available.

What to do: Apply the Microsoft security updates that shipped in the March 2017 Patch Tuesday release for every affected Windows version; for out-of-support editions (Vista, Windows 7, 8.1, Server 2008/2012), either obtain Extended Security Updates, upgrade to a supported OS, or accept documented risk. Because ransomware operators are known to use this flaw to escalate to SYSTEM, prioritize legacy Windows servers and workstations in your estate, verify their patch level, and restrict execution of untrusted local applications.