CVE-2026-29923 - Local Privilege Escalation via Arbitrary Physical Memory Mapping

The pstrip64.sys kernel driver exposes an IOCTL that allows low-privileged users to map arbitrary ranges of physical memory into their own virtual address space. This primitive allows full read/write access to the system's physical RAM, enabling attackers to modify critical kernel structures and escalate privileges to NT AUTHORITY\SYSTEM.

The driver creates a device object \Device\PSTRIP64 and a symbolic link \DosDevices\PSTRIP64 accessible by users.

The vulnerability exists in the DispatchDeviceControl routine, specifically the handler for IOCTL 0x80002008. The function sub_11000 opens a handle to \Device\PhysicalMemory and maps it directly into the calling process's address space via ZwMapViewOfSection. It accepts a physical address and length from the input buffer, translates it via HalTranslateBusAddress, and maps it using ZwCurrentProcess(). An attacker can scan physical memory to find the _EPROCESS structure of their own process and overwrite the security token to System, or patch kernel code directly.

A similar vulnerability was first seen on CVE-2008-5725 for the pstrip.sys file on previous versions of the app, where the PowerStrip driver using IOCTL 0x800020A8 allows the attacker to pass a destination address (such as HalDispatchTable) and data to be written to that address. The one found this time with the latest version explicitly allows a user to map any physical memory into their own process. The attacker maps physical RAM, scans for their own process structure, and manually edits their token to gain Admin privileges. Acting directly on memory.

Vulnerable Code Logic

RtlInitUnicodeString(&DestinationString, L"\\Device\\PhysicalMemory");
// ...
result = ZwOpenSection(&SectionHandle, 0xF001Fu, &ObjectAttributes);
// ...
v8 = ZwMapViewOfSection(..., (HANDLE)0xFFFFFFFFFFFFFFFFLL, ...);

Exploitation

A PoC was developed to demonstrate privilege escalation, however, no code will be made available publicly to avoid misuse.

1. The PoC iterates through physical memory in 2MB chunks.
2. It scans for _EPROCESS structures by validating the PID, ImageFileName, and Token pointer validity.
3. Upon locating the _EPROCESS for the "System" process and the attacker's process, the tool copies the System Token value to the attacker's Token field.
4. The attacker's process gains SYSTEM privileges.