Windows Kernel Graphics Driver Attack Surface
summary
Windows WDDM kernel drivers expose four concrete kernel entry points — escape, render, allocation, query adapter — many callbacks (40–60) and per-driver private blobs; large vendor drivers (several MBs) implement custom binary protocols. A hooking snooper tool captures real adapter/device/context traffic (PowerPoint transitions were used) and a mutating fuzzer quickly triggers crashes in AMD and VirtualBox drivers; several bugs are reported and some patches are already issued. The attacker-controllable fields are probe/captured pointers and sizes.
AI-written summary · about
chapters (9)
- 0:00Introduction to WDDM
- 15:18Driver entry points
- 22:25Escape entry point
- 28:06Render entry point
- 33:00Allocation entry point
- 34:37Query adapter entry point
- 37:14Debugging and user mode
- 42:13Sniffing driver traffic
- 45:37Fuzzing and conclusions
related talks
33mExploring a New Class of Kernel Exploit Primitive
46mFor The Win: The Art Of The Windows Kernel Fuzzing
46mD2T2 - Over The Edge: Pwning The Windows Kernel
40mCommSec D1 - The Life & Death of Kernel Object Abuse
32mEnhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis
43mDefeating Windows Anti-Exploit & Security Features with WHQL Kernel Drivers
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
40mWindows Kernel Patch Protection - Achilles Heel: PatchGuard