nhh9905/cve-2026-34344CVE-2026-34344 के लिए PoC, एक Windows afd.sys टाइप कन्फ्यूजन जो AfdQueryProviderInfo के माध्यम से कर्नेल क्रैश का कारण बनता है। इसमें ट्रिगर कोड, क्रैश लॉग और विश्लेषण शामिल है।
Type Confusion भेद्यता द्वारा क्रैश प्रदर्शित किया है। हालाँकि, मेरे पास इस भेद्यता का शोषण करने के लिए कोई प्रिमिटिव नहीं है।Type Confusionafd.sysAfdQueryProviderInfoWskProIRPSend में, कर्नेल के पास SecurityContext->SecurityQos तक पहुँच होती है, जो AfdQueryProviderInfo में है:provider_query_request.query_typeAfdQueryProviderInfo:
*(_QWORD *)&provider_query_request.query_type = 2;
provider_query_request.f_08_ = 0;
query_status = AfdIssueDeviceControl(
(PFILE_OBJECT)file_object,
&provider_query_request,
0x10u,
provider_info_buffer,
0x28u,
0xCu);
AfdIssueDeviceControl:
memmove(¤t_stack[-1].Parameters, input_buffer, input_size_32);// size = 0x10
-> SecurityContext->SecurityQos = 2 = provider_query_request.query_type
IopfCallDriver:
CurrentStackLocation = Irp->Tail.Overlay.CurrentStackLocation - 1; // -0x48
Irp->Tail.Overlay.CurrentStackLocation = CurrentStackLocation;
WskProIRPSend:
SecurityContext = CurrentStackLocation->Parameters.Create.SecurityContext;// CurrentStackLocation+8 = -0x40
if ( LOWORD(SecurityContext->SecurityQos) != 0xACE2 ) // -> Crash
1: kd> g
KDTARGET: Refreshing KD connection
*** Fatal System Error: 0x0000003b
(0x00000000C0000005,0xFFFFF80323798938,0xFFFFFA80B0D863A0,0x0000000000000000)
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
For analysis of this file, run !analyze -v
nt!DbgBreakPointWithStatus:
fffff803`8f2fb1b0 cc int 3
1: kd> kb
# RetAddr : Args to Child : Call Site
00 fffff801`d15b1992 : ffffdd02`0ec6d2a8 00000000`00000001 00000000`00000100 fffff801`d16c3e01 : nt!DbgBreakPointWithStatus
01 fffff801`d15b0ebc : 00000000`00000003 ffffdd02`0ec6d390 fffff801`d16c3f70 00000000`0000003b : nt!KiBugCheckDebugBreak+0x12
02 fffff801`d14fa437 : fffff801`64500600 ffffdd02`0ec6da60 00000000`00000001 ffffdd02`00002010 : nt!KeBugCheck2+0xb2c
03 fffff801`d16be2e9 : 00000000`0000003b 00000000`c0000005 fffff801`65998938 ffffdd02`0ec6e3a0 : nt!KeBugCheckEx+0x107
04 fffff801`d16bd33c : ffffdd02`00000001 ffffdd02`00000001 fffff801`d19664bf fffff801`d16bd2c0 : nt!KiBugCheckDispatch+0x69
05 fffff801`d16b38ff : ffffdd02`0ec6e3a0 00000000`00000000 ffffdd02`0ec6dc70 00000000`00000000 : nt!KiSystemServiceHandler+0x7c
06 fffff801`d127d5c2 : ffffdd02`0ec6dc70 fffff801`d1000000 fffff801`d16bd955 fffff801`d1116064 : nt!RtlpExecuteHandlerForException+0xf
07 fffff801`d13ddcbf : ffffdd02`0ec6e3a0 ffffdd02`0ec6e8a0 ffffdd02`0ec6e3a0 ffffdd02`0ec6eb98 : nt!RtlDispatchException+0x2d2
08 fffff801`d16be445 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffc907`9ed8a560 : nt!KiDispatchException+0x35f
09 fffff801`d16b9582 : 00000000`00000000 fffff801`d18976ec 00000000`00000002 ffffb45a`374083b0 : nt!KiExceptionDispatch+0x145
0a fffff801`65998938 : 00000000`00000000 00000000`00000000 ffffc907`9c7c3d50 00000000`00000000 : nt!KiPageFault+0x442
0b fffff801`659c6a65 : 00000000`0000000c ffffc907`9dcab1b8 00000000`00000010 ffffc907`a01628c0 : afd!WskProIRPSend+0x38
0c fffff801`d13a953b : ffffc907`9fb6a390 ffffc907`9c7c3d50 ffffc907`9fb6a390 ffffc907`9dcab010 : afd!AfdWskDispatchInternalDeviceControl+0x55
0d fffff801`d13a94b3 : 0000003f`ffffff01 ffffdd02`0ec6ef68 ffffdd02`0ec6ef58 fffff801`6599ead0 : nt!IopfCallDriver+0x5b
0e fffff801`6599eb31 : ffffc907`9fb6a390 ffffc907`9c7c3d50 00000000`00000000 ffffdd02`0ec6f120 : nt!IofCallDriver+0x13
0f fffff801`659a7bc1 : 00000000`00000000 ffffdd02`0ec6f200 ffffdd02`0ec6f2a0 ffffc907`9fb6a390 : afd!AfdIssueDeviceControl+0x111
10 fffff801`6598bdac : ffffdd02`0ec6f2a0 ffffc907`a01caea0 ffffc907`a01caea0 ffffdd02`0ec6f2a0 : afd!AfdQueryProviderInfo+0x195
11 fffff801`6598aea9 : 00000000`0000004c 00000000`00000000 ffffdd02`0ec6f2a0 ffffe081`56200000 : afd!AfdGetTransportInfo+0x1d8
12 fffff801`6599781e : ffffdd02`0ec6f290 ffffc907`9ff4b090 00000000`00000001 00000000`00000006 : afd!AfdAllocateEndpoint+0x329
13 fffff801`6599630e : ffffdd02`6d4e0000 00000000`00000000 ffffc907`a0164800 ffffc907`9a7aec50 : afd!AfdCreate+0x18e
14 fffff801`d13a953b : 00000000`00000000 ffffc907`9c7c3d50 00000000`00000005 00000000`00000000 : afd!AfdDispatch+0xfe
15 fffff801`d13a94b3 : ffffc907`9a7aedf8 00000000`00000000 ffffc907`9f735050 ffffc907`9c7c3d50 : nt!IopfCallDriver+0x5b
16 fffff801`d189a83b : 00000000`00000005 ffffdd02`0ec6f720 ffffc907`9c7c3d50 00000000`00000000 : nt!IofCallDriver+0x13
17 fffff801`d1898812 : fffff801`d189a100 00000000`00000040 ffffe081`5621f270 ffffdd02`0ec6f858 : nt!IopParseDevice+0x73b
18 fffff801`d18965e3 : ffffc907`9a7c9a01 ffffdd02`0ec6f858 00000000`00000040 ffffc907`9a824680 : nt!ObpLookupObjectName+0xd82
19 fffff801`d19664bf : 00000000`00000000 ffffc907`9f735050 000001cb`42288bf0 00000000`00000000 : nt!ObOpenObjectByNameEx+0x223
1a fffff801`d1965699 : 0000003b`be9bf7b0 ffffc907`c0100000 0000003b`be9bf7c8 0000003b`be9bf830 : nt!IopCreateFile+0xe0f
1b fffff801`d16bd955 : 00000000`00000001 0000003b`be9bdb90 ffffdd02`0ec6fb60 00000000`00000000 : nt!NtCreateFile+0x79
1c 00007ff8`866c25a4 : 00007ff6`1b2f1567 00007ff6`1b2f33c0 000001cb`42283230 0000003b`be9bf880 : nt!KiSystemServiceCopyEnd+0x25
1d 00007ff6`1b2f1567 : 00007ff6`1b2f33c0 000001cb`42283230 0000003b`be9bf880 00000000`00000000 : ntdll!NtCreateFile+0x14
1e 00007ff6`1b2f33c0 : 000001cb`42283230 0000003b`be9bf880 00000000`00000000 00000000`00000000 : poc!wmain+0x357
1f 000001cb`42283230 : 0000003b`be9bf880 00000000`00000000 00000000`00000000 00000000`00000000 : poc!`string'
20 0000003b`be9bf880 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000003 : 0x000001cb`42283230
21 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000003 00000000`00000003 : 0x0000003b`be9bf880