Proxying to Kernel:Streaming vulnerabilities from Windows Kernel
summary
Walks through concrete Windows kernel-streaming bugs: a double-fetch in property handling and a KSQL/Ktrunk path that turns a property set into an arbitrary kernel code primitive (32->64 conversion and unprotected Ioctls). Delivers working exploits that escalate to EOP on Windows 11 physical machines by flipping token privilege bits and using an arbitrary write (built PoCs, bypasses for KG and media-integrity discussed), and reports discovering over 20 kernel-streaming flaws.
AI-written summary · about
chapters (19)
- 0:00Windows kernel streaming vulns
- 2:18Focus on MSK SSRV
- 5:09What is Kernel Streaming
- 8:48Kernel Streaming architecture
- 11:38Vulnerable components in KS
- 13:24KsChunk and request mode flaw
- 16:36IOCTL request mode bypass
- 18:23Arbitrary IOCTL in Case Property
- 20:50Arbitrary code execution
- 22:17Bypassing protections
- 24:28Hyper-V limitations
- 25:32Double fetch in MSK SSRV
- 28:39Case Event IOCTL escalation
- 31:51Kernel pointer overwrite
- 33:21Token privileges abuse
- 35:55Stable exploitation
- 36:38Patch limitations
- 37:21Key takeaways
- 37:45Conclusion
related talks
39mCache the Frames, Catch the Vulnerabilities in Kernel Streaming
25mData-Only Pwning Microsoft Windows Kernel
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
46mD2T2 - Over The Edge: Pwning The Windows Kernel
33mExploring a New Class of Kernel Exploit Primitive
52mA New CVE-2015-0057 Exploit Technology
56mWindows Kernel Graphics Driver Attack Surface