CVE-2017-8481

MEDIUM

Microsoft Windows - 'nt!NtQueryInformationResourceManager (information class 0)' Kernel Stack Memory Disclosure

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2017-8481 has a selected CVSS score of 5.0 (medium); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8480, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

Affected products and versions

1
ProductSourceVersion range

Microsoft Windows

Browse Microsoft Corporation / Microsoft Windows
CVE ListMicrosoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016.affected

Proofs of concept

2

Catalogued exploits

ExploitDBMicrosoft Windows - 'nt!NtQueryInformationResourceManager (information class 0)' Kernel Stack Memory DisclosureExploitDB exploitby Google Security ResearchNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubTamatahYT/CVE-2017-8481Repository PoCby TamatahYT0Scanner1 file

5.2 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a C program that tests whether the Windows kernel information disclosure vulnerability CVE-2017-8481 is present by calling NtQueryInformationResourceManager with various buffer sizes and printing the results. It does not extract or exfiltrate sensitive kernel data; it only reports success/failure and the returned data length.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single C source file that implements a proof-of-concept for CVE-2017-8481, a Windows kernel information disclosure vulnerability. The code creates a volatile transaction manager and resource manager, sprays the kernel stack, and calls NtQueryInformationResourceManager with various buffer sizes to observe the returned data. The file includes comments stating the bug is patched and the code is for future research. No backdoor, deceptive payload, or concealed harmful behavior is present.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesC
Target softwareMicrosoft Windows kernel
Attack typesinformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code only queries the kernel with NtQueryInformationResourceManager and prints the returned status and data length. It does not read, save, or transmit the contents of uninitialized kernel memory beyond printing the returned buffer, which in the shown output contains only zeros. The author's comment confirms it failed to reproduce the bug and is for research. This is consistent with a scanner that checks for the vulnerability rather than an exploit that extracts sensitive information.

CVE-2017-8481.c:4CVE-2017-8481.c:63-78CVE-2017-8481.c:115-118

Requirements

  • The program must be executed on a Windows system with a user account that can create transaction managers and resource managers.CVE-2017-8481.c:95-104

Observed behavior

  • Dynamically resolves NtQueryInformationResourceManager from ntdll.dll.CVE-2017-8481.c:82-88
  • Creates a volatile transaction manager and a volatile resource manager.CVE-2017-8481.c:95-104
  • Calls NtQueryInformationResourceManager with buffer sizes 16, 24, 32, 40, 48, and 64 bytes and prints the NTSTATUS and returned data length.CVE-2017-8481.c:115-118
  • Includes a comment stating the code failed to reproduce the bug on Windows 11 24H2 because it is patched and is for future research.CVE-2017-8481.c:4
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Exploit Attempt
Payload withheldThe code attempts to trigger an information disclosure in the Windows kernel by querying a resource manager with different buffer sizes after spraying the kernel stack.CVE-2017-8481.c:80-124
Review boundaries

What the analysis did not establish

  • The evidence consists of a single C source file; no compiled binary, build instructions, or runtime environment details are provided.
  • The output shown in comments indicates the vulnerability was not reproduced on the tested system, so the scanner's effectiveness on vulnerable versions is unverified.
  • Only the single text file CVE-2017-8481.c was reviewed; no other files were present in the evidence packet.
  • Binary content was not analyzed per the evidence envelope policy, but no binary files were reported.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

5