CVE-2017-0148

What Is SMBv1?

Server Message Block version 1 (SMBv1) is the original Windows file and printer sharing protocol on TCP port 445. Microsoft's MS17-010 security advisory (March 2017) patched a cluster of SMBv1 vulnerabilities (CVE-2017-0143 through 0148) corresponding to NSA Equation Group tools leaked by Shadow Brokers. CVE-2017-0148 is the fifth RCE variant in this family — distinguished by its unauthenticated (PR:N) but high-complexity (AC:H) exploitation profile, different from both the unauthenticated EternalBlue (CVE-2017-0144, AC:L) and the low-privilege RCE variants (CVE-2017-0143, 0145, 0146).

Overview

CVE-2017-0148 is a remote code execution vulnerability in the Windows SMBv1 server, patched in MS17-010 (March 14, 2017). It is the fifth RCE variant in the MS17-010 family of SMBv1 vulnerabilities leaked by Shadow Brokers as NSA Equation Group tools in April 2017. CVE-2017-0148 is unauthenticated (PR:N) but requires high complexity (AC:H), indicating exploitation requires specific conditions or a more sophisticated technique than the straightforward EternalBlue exploit. Like all MS17-010 vulnerabilities, CVE-2017-0148 was used in WannaCry (May 2017) and NotPetya (June 2017). CISA added CVE-2017-0148 to the KEV catalog in April 2022.

Affected Versions

Technical Details

Root Cause: SMBv1 Buffer Overflow with High Exploitation Complexity

CVE-2017-0148 is a memory buffer vulnerability (CWE-119) in the SMBv1 server kernel driver (srv.sys). Unlike the other MS17-010 RCE variants, CVE-2017-0148 is assessed as AC:H (Attack Complexity: High), indicating that exploitation requires:

• Specific environmental conditions (particular Windows version, SMBv1 configuration, or system state)
• A race condition or timing-dependent trigger
• Prior information about the target's memory layout (potentially from CVE-2017-0147 information disclosure)
• Or a more complex payload construction than EternalBlue's straightforward approach

Unauthenticated advantage: Despite the higher complexity, CVE-2017-0148 is PR:N (no authentication required) — unlike CVE-2017-0143, 0145, 0146 which need NULL session access. This makes CVE-2017-0148 exploitable from a position where no SMBv1 session has been established, potentially useful in environments with stricter SMBv1 authentication policies that block NULL sessions.

MS17-010 Complete Vulnerability Family

All five RCE CVEs in MS17-010 target different SMBv1 code paths, ensuring broad exploitation coverage:

All are patched by MS17-010.

Attack Characteristics

Discovery

Developed by the NSA's Equation Group; disclosed publicly when Shadow Brokers published the MS17-010 toolkit on April 14, 2017 — one month after Microsoft's patch.

Exploitation Context

• Complementary toolkit coverage: CVE-2017-0148's unauthenticated but high-complexity profile complemented EternalBlue (also unauthenticated) and provided an alternative exploitation path when EternalBlue's specific technique failed; the NSA's toolkit included multiple variants for maximum target coverage
• WannaCry and NotPetya deployment: The MS17-010 toolkit that powered WannaCry and NotPetya included all five RCE variants plus the information disclosure; operators selected the appropriate exploit based on the target Windows version and configuration
• Continued active exploitation: MS17-010 exploits remain in widespread use years after the 2017 patch, targeting unpatched legacy systems; the combination of devastating historical impact and ongoing exploitation makes all MS17-010 vulnerabilities among the most important in CISA KEV
• CISA KEV (2022): Added April 2022 in a pattern of staggered KEV additions for all six MS17-010 CVEs

Remediation

1. Apply MS17-010 — the March 2017 Windows SMB Server update patches all five SMBv1 RCE CVEs (0143, 0144, 0145, 0146, 0148) and the information disclosure CVE (0147) in one patch.

2. Disable SMBv1 — on all Windows systems:

   Set-SmbServerConfiguration -EnableSMB1Protocol $false
   

3. Block TCP port 445 at perimeter and between network segments — network-level blocking is the most reliable mitigation and prevents all MS17-010 exploitation regardless of patch status.

4. Enable Windows Defender Network Protection — blocks SMBv1 traffic to known-malicious endpoints and can be configured to block all SMBv1 traffic.

5. Monitor for anomalous SMBv1 activity — SMBv1 traffic to/from non-management systems in 2024+ is anomalous; alert on unusual SMBv1 connections as a potential indicator of exploitation or lateral movement.