Security feature bypass in Microsoft Windows and Windows Server - CVE-2017-11830

Vulnerability identifier: #VU9315

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-11830

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists when Device Guard incorrectly validates an untrusted file. A remote attacker can make an unsigned file appear to be signed and trusted and trick the victim into executing it.

Microsoft Windows
Windows Server

Install updates from vendor's website.

• Exploit #6411 - Microsoft Windows - 'CiSetFileCache' TOCTOU Incomplete Fix (June 17, 2021)
• Exploit #6155 - Microsoft Windows - 'CiSetFileCache' WDAC Security Feature Bypass TOCTOU (June 17, 2021)
• Exploit #1374 - Microsoft Windows 10 - CiSetFileCache TOCTOU Security Feature Bypass (March 18, 2020)

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11830

• Signature verification bypass in Microsoft Device Guard