CVE-2017-0005

What Is the Windows Graphics Device Interface (GDI)?

The Windows Graphics Device Interface (GDI) is the kernel-mode Windows subsystem handling graphics rendering, text display, font management, and GDI object lifecycle for all Windows applications. GDI runs in kernel mode via win32k.sys, but its API is accessible from any user-mode process through standard Win32 calls. This combination — kernel-mode execution with user-mode accessibility — makes GDI kernel vulnerabilities among the highest-value privilege escalation targets in Windows. Local privilege escalation from GDI enables attackers to break out of application sandboxes and achieve full SYSTEM access from any initial code execution position.

Overview

CVE-2017-0005 is a use-after-free privilege escalation vulnerability in the Windows GDI kernel component, notable for being exploited as a zero-day by APT3 (Gothic Panda) — a sophisticated Chinese state-sponsored threat actor — before Microsoft's March 2017 patch. APT3 used CVE-2017-0005 in targeted attack campaigns against organizations in the defense, aerospace, and high-tech sectors, pairing the GDI LPE with other exploits for initial access to achieve full system compromise. Patched in MS17-013 (March 14, 2017). CISA added CVE-2017-0005 to the KEV catalog in May 2022.

Affected Versions

Technical Details

Root Cause: GDI Kernel Use-After-Free

CVE-2017-0005 is a use-after-free (CWE-416) in Windows GDI's kernel driver (win32k.sys). The GDI kernel manages the lifecycle of GDI objects (bitmaps, brushes, fonts, regions) with reference counting and object handles. A specific GDI object manipulation sequence — achievable through standard Windows GDI API calls — causes the kernel to free a GDI object while retaining a live reference pointer. When the stale pointer is later accessed, the attacker can exploit the UAF to read/write kernel memory.

Exploitation:

• Low-privilege or sandboxed code calls Win32 GDI APIs in a specific sequence
• GDI kernel UAF triggers, freeing an object while a stale handle remains
• Attacker sprays controlled data into the freed kernel memory slot
• Stale handle access reads attacker-controlled data from kernel memory
• Attacker overwrites the current process's token to escalate to SYSTEM

APT3 Zero-Day Exploitation

CVE-2017-0005 was discovered being exploited as a zero-day by APT3 (also known as Gothic Panda, UPS, TG-0110, and Boystown — a Chinese state-sponsored espionage group):

• APT3 is known for targeting US defense contractors, government agencies, and technology firms
• The zero-day was used as a privilege escalation tool in targeted attack chains — following initial access via phishing or another vulnerability, APT3 used CVE-2017-0005 to escalate to SYSTEM
• FireEye attributed the exploitation to APT3 and reported it to Microsoft as part of coordinated disclosure

Comparison to CVE-2017-0001

CVE-2017-0005 and CVE-2017-0001 are both Windows GDI kernel LPEs patched in the same MS17-013 advisory. CVE-2017-0005 is distinguished by:

• APT3 nation-state zero-day attribution (higher threat actor sophistication)
• Targeted use against specific high-value organizations

Attack Characteristics

Discovery

Discovered by FireEye researchers through threat intelligence analysis of APT3 attack campaigns. FireEye reported the zero-day to Microsoft, triggering the emergency patch in MS17-013.

Exploitation Context

• Nation-state zero-day investment: APT3's use of CVE-2017-0005 as a zero-day reflects the significant investment that sophisticated state actors make in Windows kernel vulnerability research; a zero-day GDI LPE is a valuable capability that enables breaking out of any Windows sandboxed environment
• Targeted espionage campaigns: APT3's exploitation of CVE-2017-0005 was in context of long-running espionage campaigns against US and allied nation defense and technology sectors — consistent with Chinese strategic intelligence priorities
• Exploit chain positioning: GDI LPEs are almost always stage-2 exploits in attack chains; CVE-2017-0005 follows a spear-phishing or browser exploit, converting limited initial code execution into full OS access for persistence and data exfiltration
• CISA KEV (2022): Added May 2022, confirming active exploitation with nation-state attribution

Remediation

1. Apply MS17-013 — install the March 2017 Microsoft Graphics Component update via Windows Update, WSUS, or MECM. All subsequent Windows cumulative updates include this fix.

2. Keep Windows fully updated — apply all current Windows cumulative security updates.

3. Keep initial attack vectors patched — CVE-2017-0005 requires prior code execution; maintaining current browser, Office, and PDF reader patches eliminates the initial exploitation step that precedes the GDI LPE.

4. Monitor for process token manipulation — endpoint detection tools that monitor for unexpected privilege escalation (process token changes, SYSTEM-level process spawning from user-level parents) can detect exploitation of kernel LPEs like CVE-2017-0005.