Deep-dives into Windows kernel patches — vulnerability reports with decompilations
A remote, unauthenticated stack-based buffer overflow in the Windows TCP/IP driver (tcpip.sys) lets a crafted IPv6 Hop-by-Hop options header advance the packet cursor past the NET_BUFFER bounds, corrupting memory and enabling remote code...
Read full report →A remotely reachable use-after-free in the Windows kernel TCP/IP driver tcpip.sys, where a forward-path cache entry becomes hash-table-visible before it is marked valid, letting a concurrent lookup observe and free a half-initialized ent...
Read full report →A missing 0x400 bound in tcpip.sys!FseProcessIncomingMessages let an adjacent-network attacker overflow the fixed-size WSK message-reassembly buffer with attacker-controlled length prefixes and payload, yielding kernel heap corruption an...
Read full report →A race condition in tcpip.sys's IPv4 source-route forwarding path let an unauthenticated remote attacker trigger a use-after-free on an IPP_PATH object by dropping its last reference before the forwarding code finished using it, yielding...
Read full report →No reports published in that date range.