Exploring a New Class of Kernel Exploit Primitive
summary
Microsoft MSRC evaluates an arbitrary kernel pointer read primitive that returns no data and asks whether it can yield code execution by targeting device MMIO. Methods include dumping ACPI MCFG entries and using RWEverything plus a MmMapIoSpace hook to enumerate mappings; scripts and debugger breakpoints reveal many drivers that map-and-cache MMIO into globals. Observed primitives: persistent MMIO regions, double‑fetch patterns, and timing/order bugs (WC vs uncached) that enable races. No full exploit delivered, but viable hypervisor/virtual device (vGPU) attack paths emerge.
AI-written summary · about
chapters (5)
- 0:00Start
- 11:10What is ACPI?
- 12:54ACPI MCFG Table
- 29:25MMIO Operation Race Conditions
- 30:59Parting Thoughts
related talks
22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVM
25mData-Only Pwning Microsoft Windows Kernel
56mWindows Kernel Graphics Driver Attack Surface
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
41mUsing Microarchitectural Design to Break KASLR and More
40mEvils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIs
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
24mCurrent State of Exploit Mitigations in the Linux Kernel