CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
93.5%
This security update resolves security vulnerabilities in Hyper-V, libjpeg image-process library, Win32K, Adobe Type Manager font driver, Active Directory Federation Services, Lightweight Directory Access Protocol, Windows kernel-mode drivers, OLE, Scripting Engine, Windows Graphics component and Internet Explorer in addition to these quality improvements:
Symptom | Workaround / Resolution |
---|---|
If the PC uses an AMD Carrizo DDR4 processor, installing this update will block downloading and installing future Windows updates. | This issue is resolved by KB4022717. |
If a Server 2012 R2 system uses an Intel Xeon (E3 v6) family of processors, installing this update will block downloading and installing future Windows updates. | This issue is resolved by KB4022717. |
After installing this update on Windows Server 2012 R2 DC, you may notice Kerberos Key Distribution Center (KDC) service fails to start and error events are logged in the System Event log with Event ID: 7023 - The parameter is incorrect. | Install the April 2017 Monthly Rollup Update KB4015550 |
or | |
Install the March 2017 Security-only update KB4012213. | |
This security update introduced an issue in which, if an iSCSI target becomes unavailable, attempts to reconnect will cause a leak. Initiating a new connection to an available target will work as expected. | Microsoft is working on a resolution and will provide an update in an upcoming release. For more information about this issue, see the following section. |
__
More information about the iSCSI issue
Windows Server 2012 R2 and Server 2016 computers that experience disconnections to iSCSI attached targets may show many different symptoms. These include, but are not limited to:
This issue is caused by a locking issue on Windows Server 2012 R2 and Windows Server 2016 RS1 computers, causing connectivity issues to the iSCSI targets. The issue can occur after installing any of the following updates:Windows Server 2012 R2Release date | KB | Article title |
---|---|---|
May 16, 2017 | KB 4015553 | April 18, 2017—KB4015553 (Preview of Monthly Rollup) |
May 9, 2017 | KB 4019215 | May 9, 2017—KB4019215 (Monthly Rollup) |
May 9, 2017 | KB 4019213 | May 9, 2017—KB4019213 (Security-only update) |
April 18, 2017 | KB 4015553 | April 18, 2017—KB4015553 (Preview of Monthly Rollup) |
April 11, 2017 | KB 4015550 | April 11, 2017—KB4015550 (Monthly Rollup) |
April 11, 2017 | KB 4015547 | April 11, 2017—KB4015547 (Security-only update) |
March 21, 2017 | KB 4012219 | March 2017 Preview of Monthly Quality Rollup for Windows 8.1 and Windows Server 2012 R2 |
**Windows Server 2016 RTM (RS1)**Release date | KB | Article title |
— | — | — |
May 16, 2017 | KB 4023680 | May 26, 2017—KB4023680 (OS Build 14393.1230) |
May 9, 2017 | KB 4019472 | May 9, 2017—KB4019472 (OS Build 14393.1198) |
April 11, 2017 | KB 4015217 | April 11, 2017—KB4015217 (OS Build 14393.1066 and 14393.1083) |
Verification
c:\windows\system32\drivers\msiscsi.sys
The version that will expose this behavior is 6.3.9600.18624 for Windows Server 2012 R2 and version 10.0.14393.1066 for Windows Server 2016.
* The following events are logged in the System log:Event source | ID | Text |
---|---|---|
iScsiPrt | 34 | A connection to the target was lost, but the Initiator successfully reconnected to the target. Dump data contains the target name. |
iScsiPrt | 39 | The Initiator sent a task management command to reset the target. The target name is given in the dump data. |
iScsiPrt | 9 | Target did not respond in time for a SCSI request. The CDB is given in the dump data. |
Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Sort Count
Or, from an administrative CMD prompt, run the following NETSTAT command together with the “Q” switch. This shows “bound” ports that are no longer connected:
NETSTAT –ANOQ
Focus on ports that are owned by the SYSTEM process.
For the three previous points, anything more than 12,000 should be considered suspect. If iSCSI targets are present in the computer, there is high probability that the issue will occur.
Resolution
If the event logs indicate that many reconnections are occurring, work with your iSCSI and network fabric vendor to help diagnose and correct the reason for the failure to maintain connections to iSCSI targets. Make sure that iSCSI targets can be accessed over the current network fabric. Install updated fixes when they become available. This article will be updated with the specific KB article number of the fix to install when it becomes available.
Note We do not recommend that you uninstall any of the March, April, May, or June security rollups. Doing so will expose the computers to known security exploits and other bugs that are mitigated by monthly updates. We recommend that you first work with iSCSI target and network vendors to resolve the connectivity issues that are triggering target reconnects.
How to get this updateTo get the stand-alone package for this update, go to the Microsoft Update Catalog website.
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
93.5%