Deep-dives into Windows kernel patches — vulnerability reports with decompilations
A missing bound in the Windows Reliable Multicast Transport driver (rmcast.sys) lets an unbounded interface-enumeration loop overrun a fixed 20-entry array inside the session object, corrupting adjacent kernel pointers and enabling remot...
Read full report →A use-after-free in the Windows Reliable Multicast Transport driver (rmcast.sys) inside CoalesceSelectiveNaksIntoGroups let an unauthenticated remote attacker leave a partially-linked NAK-group context on the receiver lists under memory ...
Read full report →A remote, unauthenticated stack-based buffer overflow in the Windows TCP/IP driver (tcpip.sys) lets a crafted IPv6 Hop-by-Hop options header advance the packet cursor past the NET_BUFFER bounds, corrupting memory and enabling remote code...
Read full report →A race condition in tcpip.sys's wake-pattern port management lets an adjacent-network attacker free a port entry while InetWakeAcquirePortAf is blocked mid-operation, producing a use-after-free and double-free of pool memory that can be ...
Read full report →A cached-count mismatch in the Windows kernel's WHEA initialization event logger (WheapLogInitEvent in ntoskrnl.exe) lets a local attacker drive an unbounded copy loop past a NonPagedPoolNx allocation, corrupting adjacent pool memory for...
Read full report →A use-after-free in win32kfull.sys lets a local, unprivileged attacker free a tagMENU during WM_INITMENU/WM_INITMENUPOPUP callbacks and reuse stale pointers, yielding kernel read/write and SYSTEM code execution from any window-owning pro...
Read full report →A use-after-free in the Windows CLFS driver (clfs.sys) let a local attacker persist live kernel pointers inside base-file snapshot metadata; on reload those stale pointers were dereferenced, yielding a controlled-dereference primitive fo...
Read full report →Windows NTFS validated only the header of an index buffer before enumerating its entries, letting a crafted volume drive out-of-bounds heap reads and writes in ntfs.sys. The patch adds per-entry bounds validation for both file-name and v...
Read full report →Windows Bluetooth Port Driver requests flow through the Network Store Interface in netio.sys, where NsipFindInformationProvider validated a caller-controlled provider index with a `>` comparison instead of `>=`, allowing an adjacent-netw...
Read full report →A remotely reachable use-after-free in the Windows kernel TCP/IP driver tcpip.sys, where a forward-path cache entry becomes hash-table-visible before it is marked valid, letting a concurrent lookup observe and free a half-initialized ent...
Read full report →A missing 0x400 bound in tcpip.sys!FseProcessIncomingMessages let an adjacent-network attacker overflow the fixed-size WSK message-reassembly buffer with attacker-controlled length prefixes and payload, yielding kernel heap corruption an...
Read full report →A race condition in tcpip.sys's IPv4 source-route forwarding path let an unauthenticated remote attacker trigger a use-after-free on an IPP_PATH object by dropping its last reference before the forwarding code finished using it, yielding...
Read full report →No reports published in that date range.