How to Fix CVE-2017-0143: Remote Code Execution in Windows SMB

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚠️ Patch immediately. CVE-2017-0143 is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03). Federal agencies had until 2022-05-03 to remediate.

What is CVE-2017-0143?

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.

The flaw lives in how the SMBv1 server parses certain crafted request packets. By sending a malformed sequence to TCP port 445, an unauthenticated remote attacker can corrupt memory in the kernel-mode srv.sys driver and execute arbitrary code in the SYSTEM context. No credentials and no user interaction are required, which is why the CVSS 3.1 base score is 8.8 and the attack vector is NETWORK with attack complexity LOW.

CVE-2017-0143 is one of the four SMBv1 server bugs Microsoft fixed in the single bulletin MS17-010 on 14 March 2017. The others are CVE-2017-0144, CVE-2017-0145, CVE-2017-0146 and CVE-2017-0148. Collectively the exploit chain built on these is known as EternalBlue. It is the same chain that drove the WannaCry ransomware outbreak in May 2017 and the NotPetya wiper in June 2017, and it is frequently paired with the DoublePulsar kernel backdoor for persistence. CISA confirmed in-the-wild exploitation and added the CVE to its Known Exploited Vulnerabilities catalog, so this is not a theoretical risk.

The single most effective defensive action, beyond installing MS17-010, is to disable SMBv1 entirely. SMBv1 is a legacy protocol that Microsoft deprecated; modern Windows clients and servers negotiate SMBv2 or SMBv3 and do not need SMBv1 enabled.

Identify

You're exposed if you run any of the Windows versions in the Affected row, the MS17-010 update is missing, and SMBv1 is still enabled. Run these checks from an elevated PowerShell prompt.

First, confirm your build and whether one of the MS17-010 KBs is present:

# OS build
[System.Environment]::OSVersion.Version

# Is an MS17-010 patch installed? (KB list varies by OS, see the "Fixed in" row)
Get-HotFix -Id KB4012212,KB4012215,KB4012213,KB4012216,KB4012214,KB4012217,`
              KB4012606,KB4013198,KB4013429,KB4012598 -ErrorAction SilentlyContinue

Next, check whether the vulnerable SMBv1 server is actually enabled. If this returns EnableSMB1Protocol : False (or the feature is removed), the attack surface for this CVE is already closed:

# Windows 8.1 / Server 2012 R2 and newer
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol

# Windows 8.1 / Server 2012 R2 and newer: check the optional feature
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

How to fix CVE-2017-0143

There are two things to do, and you should do both: install the MS17-010 security update, and disable the legacy SMBv1 protocol so the vulnerable code path cannot be reached at all. This is a Windows-only fix. There is no Linux package to upgrade for this CVE; the vulnerable code is the Windows kernel-mode SMBv1 server driver (srv.sys), shipped only with Windows.

Step 1, install the MS17-010 update

On any supported, internet-connected machine the fastest route is Windows Update. From an elevated PowerShell prompt:

# Use the built-in update client to pull pending security updates
Install-Module -Name PSWindowsUpdate -Force -Scope CurrentUser
Import-Module PSWindowsUpdate
Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -Install -AutoReboot

For offline, end-of-life, or tightly change-controlled hosts, download the exact KB for the OS from the Microsoft Update Catalog and install the .msu with wusa.exe. Match the KB to your build using the Fixed in row above. For example, on Windows 7 SP1 or Server 2008 R2 SP1:

# Example: Windows 7 SP1 / Server 2008 R2 SP1 security-only update KB4012212
# Download the .msu manually from https://www.catalog.update.microsoft.com (search: KB4012212)
$msu = "$env:TEMP\windows6.1-kb4012212-x64.msu"
Start-Process -FilePath wusa.exe -ArgumentList "`"$msu`" /quiet /norestart" -Wait
Restart-Computer -Force

Windows XP, Windows 8 RTM, and Server 2003 were already out of support in 2017, but Microsoft released an exceptional out-of-band MS17-010 fix for them (KB4012598). If you still run those, apply that update. the EternalBlue exploits target them directly.

Step 2, disable SMBv1

Disabling SMBv1 removes the vulnerable code path. Do this even after patching. On Windows 8.1 / Server 2012 R2 and newer:

# Turn off the SMBv1 server (no reboot needed for this setting)
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# Remove the SMBv1 client/server optional feature entirely (reboot required)
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

On Windows 7 / Server 2008 R2, which lack the Set-SmbServerConfiguration cmdlet, disable the server via the registry and restart the Server service:

# Windows 7 / Server 2008 R2: disable SMBv1 server
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" `
  -Name SMB1 -Type DWORD -Value 0 -Force
Restart-Service -Name LanmanServer -Force

Combined remediation script (PowerShell, run as Administrator)

# Vendor advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143
# Patch MS17-010 + disable SMBv1, with logging. Run elevated.
$ErrorActionPreference = 'Stop'
$log = "$env:ProgramData\CVE-2017-0143-remediation.log"
function Write-Log($msg) { "$(Get-Date -Format s)  $msg" | Tee-Object -FilePath $log -Append }

Write-Log "Starting CVE-2017-0143 (MS17-010 / SMBv1) remediation"

# 1. Detect: is any MS17-010 KB already present?
$ms17010 = 'KB4012212','KB4012215','KB4012213','KB4012216','KB4012214','KB4012217',
           'KB4012606','KB4013198','KB4013429','KB4012598'
$present = Get-HotFix | Where-Object { $ms17010 -contains $_.HotFixID }
if ($present) {
    Write-Log "MS17-010 already installed: $($present.HotFixID -join ', ')"
} else {
    Write-Log "MS17-010 not detected, install it via Windows Update or the matching KB before continuing."
}

# 2. Disable the SMBv1 server (closes the vulnerable code path regardless of patch state)
if (Get-Command Set-SmbServerConfiguration -ErrorAction SilentlyContinue) {
    Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
    Write-Log "SMBv1 server disabled via Set-SmbServerConfiguration"
} else {
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" `
        -Name SMB1 -Type DWORD -Value 0 -Force
    Restart-Service -Name LanmanServer -Force
    Write-Log "SMBv1 server disabled via registry (legacy OS)"
}

# 3. Verify SMBv1 is off
$state = (Get-SmbServerConfiguration -ErrorAction SilentlyContinue).EnableSMB1Protocol
Write-Log "EnableSMB1Protocol is now: $state"
if ($state -eq $false -or $present) {
    Write-Log "SUCCESS: host remediated for CVE-2017-0143"
} else {
    Write-Log "FAILURE: SMBv1 still enabled and MS17-010 not detected"
    exit 1
}

If you can't patch immediately

If you cannot install MS17-010 right away, you can still cut off the attack at the network and host level. These reduce blast radius but are not a replacement for the update.

Block SMB at the perimeter and between segments

SMBv1 should never be reachable from the internet. Block inbound TCP 445 (and the legacy NetBIOS ports 137-139) at the firewall, and restrict it between internal segments to only the hosts that genuinely need file sharing. On a Windows host you can block the port locally with Windows Defender Firewall:

# Block inbound SMB (TCP 445) at the host firewall as a stopgap
New-NetFirewallRule -DisplayName "Block SMB 445 inbound (CVE-2017-0143 stopgap)" `
  -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block

Note that blocking 445 also breaks legitimate file and printer sharing, so treat it as a temporary measure until the update and SMBv1 removal are done. Pair it with EDR or IDS signatures for EternalBlue and DoublePulsar so any exploitation attempt during the window is alerted on.

Resolve

Confirm both halves of the fix landed. First, that an MS17-010 KB is installed:

# The relevant MS17-010 KB for this OS should be listed
Get-HotFix | Where-Object { $_.HotFixID -in 'KB4012212','KB4012215','KB4012213',`
  'KB4012216','KB4012214','KB4012217','KB4012606','KB4013198','KB4013429','KB4012598' }

Second, that the SMBv1 server is off:

(Get-SmbServerConfiguration).EnableSMB1Protocol   # should return False

Expected result: the matching KB appears with an InstalledOn date inside your patch window, and EnableSMB1Protocol returns False. Then re-run whatever vulnerability scanner flagged the host and confirm the CVE-2017-0143 / MS17-010 finding has cleared. Because this family was so heavily weaponized, sweep for indicators of compromise: an active DoublePulsar implant (it can be detected with the public DoublePulsar detection scripts), unexpected SMB connections from outside your network, and new SYSTEM-level scheduled tasks or services created during any window the host was internet-reachable.

Frequently asked questions

Is CVE-2017-0143 being actively exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog, which means in-the-wild exploitation has been observed and confirmed.

How severe is CVE-2017-0143?

CVSS rates it 8.8 (High). Use that score to set your patch priority next to the other items in your queue.

Which update fixes CVE-2017-0143?

Microsoft bulletin MS17-010, released on 14 March 2017. The specific KB depends on your OS: KB4012212 or KB4012215 for Windows 7 / Server 2008 R2, KB4013429 for Windows 10 1607 / Server 2016, KB4012598 for the out-of-band Vista / XP / Server 2003 / 2008 fixes, and so on. See the "Fixed in" row above for the full per-OS list.

Is this the same vulnerability as EternalBlue and WannaCry?

It is part of it. CVE-2017-0143 is one of four SMBv1 server bugs fixed together in MS17-010 (alongside CVE-2017-0144, 0145, 0146 and 0148). The EternalBlue exploit and the WannaCry and NotPetya outbreaks targeted this SMBv1 server flaw set. Patching MS17-010 and disabling SMBv1 addresses all of them.

If I disable SMBv1, do I still need to install MS17-010?

Disabling SMBv1 removes the vulnerable code path and is the strongest single mitigation, but you should still install MS17-010. The update protects any host where SMBv1 cannot yet be disabled (for example, due to a legacy dependency), and applying both gives you defense in depth. Disable SMBv1 wherever nothing legitimately depends on it.

References

• Official vendor advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-0143
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Additional reference: https://www.exploit-db.com/exploits/41891/
• Additional reference: http://www.securityfocus.com/bid/96703
• Additional reference: http://www.securitytracker.com/id/1037991

Written by Sai Kiran Pandrala on 2026-05-25. Sourced from the official vendor advisory, the NVD record, and the CISA KEV listing. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Nearby vulnerabilities you may as well remediate alongside this fix:

• How to Fix CVE-2017-0262: Security vulnerability in Microsoft Office
• How to Fix CVE-2017-8464: Security vulnerability in Windows Shell
• How to Fix CVE-2017-0222: Out-of-bounds write in Internet Explorer
• How to Fix CVE-2017-0037: Type Confusion in Microsoft Edge and Internet Explorer
• How to Fix CVE-2017-0145: Security vulnerability in Windows SMB