CVE-2025-21333

Hyper-V NT Kernel Integration VSP (vkrnlintvsp.sys) Paged Pool heap overflow → Local Privilege Escalation (LPE).
This directory contains lab PoC source code (based on MrAle98/CVE-2025-21333-POC, including a local patch).

1. Vulnerability Summary

Root Cause

In VkiRootAdjustSecurityDescriptorForVmwp:

1. Calculate allocation length using WORD: AclSize + sid1 + sid2 + 16
2. When AclSize = 0xfff0, sum is 0x10040 → truncated to 0x40
3. ExAllocatePool2(..., 0x40, 'ViRo')
4. memmove(pool, dacl, AclSize) still copies the full 0xfff0

Core inequality: allocatedBytes(0x40) < accessEnd(0xfff0).

KD dynamic confirmation:

• ExAllocatePool2 → @rdx = 0x40
• memmove → @r8 = 0xfff0

Trigger Path

Requires enabling Windows Sandbox (and Nested Virtualization) so that the relevant syscall enters vkrnlintvsp.sys:

PoC → NtCreateCrossVmEvent
    → VkiRootCalloutCreateEvent
    → VkiRootAdjustSecurityDescriptorForVmwp

2. Reproduced System Version

Patched 23H2 (≥ 22631.4751) not reproducible. Requires enabling Nested Virtualization + Windows Sandbox.

3. Exploitation Chain (Brief)

1. Spray WNF_STATE_DATA
2. Dual-ACE construct AclSize=0xfff0, trigger overflow, enlarge adjacent WNF DataSize
3. Free two holes, then allocate: IrRB (I/O Ring RegBuffers) + NpAt (PipeAttribute)
4. Overwrite one entry in RegBuffers → forge IOP_MC_BUFFER_ENTRY in user mode
5. IoRing Read/Write → arbitrary kernel read/write
6. Token replacement → PRIV_ESC_OK → session-bound visible SYSTEM shell

Expected layout: 0x30 IrRB + 0x80 NpAt (requires found1=1 && found2=1).

4. Local Stabilization Key Points (22631.3447)

Mandatory contract relative to upstream:

Heap spray layout is non-deterministic, privilege escalation not 100%; can retry on failure.

5. Reference Links

• MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21333
• Upstream analysis: https://medium.com/@ale18109800/cve-2025-21333-windows-heap-based-buffer-overflow-analysis-d1b597ae4bae
• Upstream PoC: https://github.com/MrAle98/CVE-2025-21333-POC
• I/O Ring Primitive: https://windows-internals.com/one-i-o-ring-to-rule-them-all-a-full-read-write-exploit-primitive-on-windows-11/