[CB24]Proxying to Kernel:Streaming vulnerabilities from Windows Kernel
Security researchers examine technical aspects of [CB24]Proxying to Kernel:Streaming vulnerabilities from Windows Kernel.
Summary
Research Motivation
Angelboy, a Microsoft MVP security researcher, presents Windows kernel streaming vulnerability research. He chose MSKSSRV over crowded targets like win32k and cldflt after reviewing historical in-the-wild bugs, noting MSKSSRV's smaller codebase enables faster review.
Prior Kernel Streaming Bugs
The talk surveys prior MSKSSRV issues including a Pwn2Own logical flaw mapping kernel addresses to user space, CVE-2023-36802 type confusion, and a Pwn2Own UF vulnerability—demonstrating the component's exploitability.
Kernel Streaming Architecture
Windows kernel streaming handles webcams, microphones, and multimedia devices via KS filters, pins, properties, and IOCTL paths through ks.sys, ksthunk, and stream class drivers. Understanding device enumeration, aperture instances, and property IOCTLs guides vulnerability hunting.
Methodology
The researcher emphasizes studying past vulnerabilities and Windows implementation details to identify new flaws in frequently used but complex multimedia kernel components.
Related talks
Black Hat·24 min
Rancho Han
Analysts investigate attack surfaces and defenses concerning Discovering 20 Year Old Vulnerabilities in Modern Windows Kernel.
HEXACON 2024·41 min
Engineers explore architecture and security mechanisms for HEXACON2024 - Streaming vulnerabilities from the Windows Kernel by An-Jie Yang.
Black Hat·43 min
Presenters detail vulnerability discovery and exploitation in Social Engineering The Windows Kernel: Finding And Exploiting Token Handling Vulnerabilities.