Cache the Frames, Catch the Vulnerabilities in Kernel Streaming

on YouTube ↗39m

" summary

Research uncovers more than 20 kernel‑streaming bugs and builds working exploits that reach kernel EOP on modern Windows (tested on 22H2 and 24H2). Root causes are concrete: a missing size check in the MDL catch buffer overflow path (two bugs), header/MDL pairing mismatch when submitting multi‑frame IOCTLs, and a forgotten lock leading to arbitrary physical write via MDL misuse. Exploitation uses IOCTLs, MDL plumbing, pipe spray and lookaside list corruption; demos successfully write controlled data to kernel memory and achieve EOP.

AI-written summary · about

" chapters (8)

1. 0:00Kernel streaming vulnerabilities
2. 4:43Frame handling issues
3. 8:55MDL cache overflow
4. 12:52MDL mismatch overflow
5. 18:33Forgotten lock exploitation
6. 28:04Frame misalignment attack
7. 37:36Exploitation and impact
8. 38:17Research takeaways

" related talks

• 39mProxying to Kernel:Streaming vulnerabilities from Windows KernelAngelboy Yang · CODE BLUE 2024
• 44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019Tong Lin, Luhai Chen · Linux Security Summit Europe 2019
• 46mD2T2 - Over The Edge: Pwning The Windows KernelRancho Han · Hack In The Box Amsterdam 2018
• 27mThe Most Dangerous Codec in the World: Finding and Exploiting Vulnerabilities in H.264 DecodersStephen Checkoway, Hovav Shacham, Willy R. Vasquez · Black Hat USA 2023
• 51mExploiting Hardware Glitches And Side Channels In Perfect SoftwareHerbert Bos · OWASP Global AppSec Amsterdam 2019
• 33mExploring a New Class of Kernel Exploit PrimitiveRohit Mothe, Andrew Ruddick · Black Hat Europe 2022
• 52mA New CVE-2015-0057 Exploit TechnologyYu Wang · Black Hat Asia 2016
• 56mWindows Kernel Graphics Driver Attack SurfaceIlja van Sprundel · Black Hat USA 2014