CVE-2017-11814: Infoleak

Published Oct 13, 2017

Updated

The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows an information disclosure vulnerability when it improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11765, CVE-2017-11784, and CVE-2017-11785.

Affected Software

12 affected components

Microsoft Windows 10

Microsoft Windows 10=1511

Microsoft Windows 10=1607

Microsoft Windows 10=1703

Microsoft Windows 7=sp1

Microsoft Windows 8.1

Microsoft Windows RT 8.1

Microsoft Windows Server 2008=sp2

Microsoft Windows Server 2008=r2-sp1

Microsoft Windows Server 2012

Microsoft Windows Server 2012=r2

Microsoft Windows Server 2016

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11814

Event History

Oct 13, 2017

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Systems running the listed affected Windows client, server, or RT releases are exposed if they have not applied the available patch. The affected systems include Windows 7 SP1 through Windows 10 version 1703 and the specified Windows Server releases.

What access does an attacker need to exploit it?

The CVSS vector indicates local access and low privileges are required. No user interaction is required, and successful exploitation can disclose information without affecting integrity or availability.

Is a patch available?

Yes. The provided remediation information states that a patch is available.