EternalBlue: RCE in SMBv1

EternalBlue is the clearest case study in the gap between a patch existing and a patch being applied.

Microsoft shipped MS17-010 on 14 March 2017. The Shadow Brokers dumped the NSA exploit on 14 April. WannaCry hit on 12 May, NotPetya on 27 June. Every organisation that burned in May and June had been able to patch for two months.

#The bug

The exploit chains several issues in the SMBv1 server driver (srv.sys). The core one is a size-calculation error in the conversion of OS/2 extended-attribute lists.

SMB inherited a structure from OS/2 called a FEA list — File Extended Attributes. Windows converts between two representations of it, and the routine that computes how much space the converted list needs used a WORD where the copy loop used a DWORD.

The result is a classic integer-truncation overflow: a list whose true size exceeds 16 bits wraps when the size is computed, the driver allocates a buffer based on the wrapped small value, and then copies the full untruncated length into it. The overflow lands in the non-paged kernel pool.

Two further primitives complete the chain — a related transaction-handling confusion that lets the attacker groom the pool, and the SESSION_SETUP path used to place data at a predictable location. Together they turn the overflow into controlled kernel execution.

#Why it mattered

The consequence is not a shell as a service account. It is arbitrary code execution in ring 0, pre-authentication, from a single crafted packet to TCP/445. There is no user to phish and no credential to steal. SYSTEM is the floor, not the ceiling.

That is also why it wormed so effectively. A vulnerability that needs no credentials and no interaction can propagate autonomously, and SMB is the one protocol guaranteed to be reachable between machines inside a Windows network.

Which points at the real lesson of 2017: both outbreaks did most of their damage laterally, inside the perimeter. Organisations that had firewalled 445 at the edge and considered the job done watched the worm move freely between workstations that trusted each other completely. NotPetya's estimated $10B in damages was overwhelmingly internal spread.

DoublePulsar, the kernel implant usually staged by EternalBlue, is worth knowing separately — it persists in kernel memory and is frequently what a compromised host is still running after the initial exploit has been forgotten.

#Detection

• Inventory SMBv1 usage first. The question is not "are we patched" but "why is SMBv1 enabled at all." On modern Windows it is removable as a feature: Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol.
• Patch state: MS17-010 across every Windows version, including the out-of-band updates Microsoft issued for XP and Server 2003 — an extraordinary step that signals how bad this was.
• Network: SMB traffic crossing segments that have no business sharing files, and any SMB on 445 traversing the edge in either direction.
• Host: DoublePulsar responds to a specific SMB Trans2 request with a distinctive Multiplex ID, which is how most scanners fingerprint an existing implant rather than just a missing patch.

#Fixing it

Patch, then disable SMBv1 entirely. It has been deprecated since 2014 and removed from default installs since Windows 10 1709. There is no configuration in which SMBv1 is the right answer in 2026; if something still needs it, that system is the finding.

Then segment. The patch closes this bug; segmentation closes the next one.

#What generalises

Integer truncation between a size calculation and a copy operation is a permanent fixture of memory-unsafe protocol parsers, and SMB is a protocol with thirty-five years of accreted backwards compatibility to hide such bugs in.

But the transferable lesson is operational. The technical control (a patch) existed and was free. What failed was patch velocity on internal systems that were assumed safe because they were not internet-facing. Flat internal networks turn any single wormable bug into an enterprise-wide outage — and that assumption, not the FEA conversion routine, is what actually cost ten billion dollars.