Researchers Detail Windows Kernel AFD Vulnerability and Local Privilege-Escalation Exploit
· 27:05 · Watch on YouTube ↗
Summary
Junoh Lee and JeongOh Kyea describe a Windows kernel AFD Fast I/O integer-overflow bug triggered by racing changes to a user buffer, then explain a heap-overflow exploit strategy for local privilege escalation and demonstrate it on Windows 11.
Key points
- The researchers selected the AFD Windows function driver after reviewing past kernel vulnerabilities and looking for overlooked code paths.
- They identified a race between AFD's user-buffer length validation and its later copy: changing the chunk-size value between those operations can trigger an integer overflow.
- The overflow lets an oversized copy write beyond a kernel heap buffer; the talk says the vulnerable path was reachable from a 32-bit process using a UDP endpoint.
- To limit the risk of a kernel crash during exploitation, they describe placing unmapped memory after the user-mode source buffer so an exception stops the copy.
- Their exploit sprays I/O completion context objects and corrupts a Port member to obtain an arbitrary decrement primitive and alter the current thread's PreviousMode.
- The presenters demonstrate the resulting local privilege escalation on Windows 11.
Article Details
- Topics
- [00:57] Selecting Windows kernel driver targets and narrowing research to the AFD driver
- [06:01] Fast I/O dispatch as an overlooked Windows kernel attack surface
- [07:47] AFD chunk-size alignment integer overflow and race condition
- [15:00] Controlling the kernel heap overflow and limiting the risk of a crash
- [19:37] Selecting an I/O completion context object for privilege escalation
- [25:07] Heap spraying, corrupting the target object, and demonstrating the exploit