Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis
summary
A static analysis pipeline combining symbolic execution and taint analysis targets IRP_MJ_DEVICE_CONTROL handlers in WDM drivers, hooks common kernel APIs, and applies custom heuristics to reduce path explosion. The tool analyzes drivers offline, reports vulnerability type, address and constraints, and finds 117 vulnerabilities across 26 unique drivers in the study, leading to 41 CVEs assigned; the prototype runs end-to-end but some cases require manual tuning or proofs of concept.
AI-written summary · about
chapters (11)
- 0:00Vulnerability hunting in WDM drivers
- 1:10WDM drivers and vulnerabilities
- 4:01BYOD attacks explained
- 5:29Symbolic execution basics
- 7:15ICT Lens design
- 9:26Nine vulnerability types
- 17:24Arbitrary kernel code execution
- 22:47Performance enhancements
- 27:52Evaluation with drivers
- 30:30Limitations and manual review
- 31:35Conclusion
related talks
34m1-Click-Fuzz：Systematically Fuzzing the Windows Kernel Driver with Symbolic Execution.
56mWindows Kernel Graphics Driver Attack Surface
33mIdentifying Multi-Binary Vulnerabilities in Embedded Firmware at Scale
57mFinding, Managing, Preventing Vulnerabilities: An Automotive Perspective
53mResearching New Attack Interfaces On iOS And OSX
45mFinding Vulnerabilities through Static Analysis and Scripting
52mAnatomy of a Vulnerability Response - A View from the Inside
33mSecuring the Unseen: Vulnerability Research in Confidential Computing