So this is no doubt going to be fun. However, let's be realistic about risk:
1. Core SMB sits in kernel space and KASLR is great at mitigating exploitation.
2. Asssuming this is kernel space, any unsuccessful exploitation results in BSOD. 1/
zdnet.com/article/detail…
1. Core SMB sits in kernel space and KASLR is great at mitigating exploitation.
2. Asssuming this is kernel space, any unsuccessful exploitation results in BSOD. 1/
zdnet.com/article/detail…
3. Nobody has working PoC trigger code yet that I'm aware of, though the description tells us where to look for the vuln.
4. Many orgs bit by WannaCry and NotPetya have looked at how they segment networks and how they treat SMB in general (though many have not). 2/
4. Many orgs bit by WannaCry and NotPetya have looked at how they segment networks and how they treat SMB in general (though many have not). 2/
5. Even with trigger code, you still have to remotely bypass KASLR (not an easy task). If you need proof, look at BUCKEYE. They had the EternalBlue trigger, but had to chain it with another information disclosure vulnerability to gain code execution. This isn't easy. 3/
The TL;DR here is that this IS serious, but it isn't WannaCry 2.0. Fewer systems are impacted and there's no readily available exploit code. I'm not thrilled about another SMB vuln, but we all knew this would come (and this won't be the last). Hysteria is unwarranted though. /FIN
