D2T2 - Over The Edge: Pwning The Windows Kernel
summary
15+ kernel vulnerabilities in the Windows graphics stack lead to multiple Edge-to-SYSTEM escapes with full exploits and demos, including previously disclosed CVE-2017-8465/CVE-2017-8580 and a CVE affecting Dxgk. Exploitation techniques combine object reuse and heap feng shui to reclaim freed GDI/bitmap/palette memory, a cursor unlink double-free to craft fake objects, a duplicate-handle bug in Chakra to hijack a JIT helper process, and a DirectX/Dxgk command chain that gains RDI/RAX control for kernel ROP.
AI-written summary · about
chapters (41)
- 0:00Intro
- 0:13Opening
- 0:54Introduction
- 1:42Team
- 2:53Presentation
- 5:56Object types
- 6:20Widgets
- 6:34Relationship
- 8:22Point Of View
- 8:40Deep Dive
- 9:39API FN
- 10:09Banana Attack
- 11:04Review
- 11:43Callback Table
- 12:17Sample Code
- 13:56Public Object
- 17:20Microsoft
- 17:50Sandbox
- 18:58CVG
- 20:30User
- 21:34Cursor
- 22:25Free For Use
- 23:41Exploit
- 25:20Bypass
- 26:41JIT Server
- 27:18Vendor Permissions
- 28:18JIT Client
- 28:54Jetty
- 30:09The root cause
- 31:09Whats wrong
- 31:58Public Palette
- 32:50Device Contest
- 33:36Code Review
- 34:08Exploit Steps
- 34:59Project Error
- 35:55Conference Check
- 39:15System Process
- 41:19Gadget
- 42:04Code Execution
- 44:14Questions
- 45:47Would it have helped
related talks
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
56mWindows Kernel Graphics Driver Attack Surface
39mCache the Frames, Catch the Vulnerabilities in Kernel Streaming
52mA New CVE-2015-0057 Exploit Technology
25mData-Only Pwning Microsoft Windows Kernel
46mFor The Win: The Art Of The Windows Kernel Fuzzing
39mProxying to Kernel:Streaming vulnerabilities from Windows Kernel
53mUnderstanding TOCTTOU in the Windows Kernel Font Scaler Engine