Pwn2Own with Microslop Chaining CLDFLT and DirectX Kernel Ra...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://dungnm.hashnode.dev/pwn2own-with-microslop
• Blog Title: Pwn2Own with Microslop: Chaining CLDFLT and DirectX Kernel Race Conditions for Windows LPE
• Suggested Section: Windows Hardening > Windows Local Privilege Escalation > Kernel Race Conditions and Use-After-Free; cross-reference Binary Exploitation > Common Exploiting Problems and the existing Windows I/O ring/kernel arbitrary read-write material

🎯 Content Summary

Overview and impact

The post documents a Windows 11 kernel local privilege-escalation chain developed by Viettel Cyber Security for Pwn2Own Desktop 2026. It combines two AI-discovered race-condition use-after-free vulnerabilities: an unidentified, pre-competition-patched flaw in the Windows Cloud Files Mini Filter Driver, cldflt.sys, which provides repeated writes of a predictable but uncontrolled kernel timer value; and CVE-2026-50493 in the DirectX grap...

🔧 Technical Details

Cancel-safe queue lifetime race: Audit drivers for queue-processing code that acquires a cancel-safe queue lock, completes an operation and frees its queue object before releasing the lock. Race that path against cancellation. A cancellation thread may already retain the object pointer while waiting for the lock; after completion frees the object and releases the lock, cancellation resumes and invokes the queue-removal callback with the stale pointer, producing a UAF.

Reclaiming a freed queue object with a fake linked list: Spray a controllable, same-sized pool object into a freed queue-object slot. Replace the stale object's list links with a cyclic linked list in mapped user memory and make each element resemble the driver's expected request structure. If the kernel queue walker accepts those addresses, it repeatedly processes attacker-defined fake requests instead of terminating at the original list head.

Deriving repeated wri...

🤖 Agent Actions

Done.

Updated:

• src/windows-hardening/windows-local-privilege-escalation/README.md

Added a new Drivers subsection covering:

• cancel-safe queue lifetime races / stale CBD reuse
• reclaiming freed queue objects with NPFS Data Queue Entries
• converting predictable kernel writes into length-field corruption and OOB paged-pool reads
• lock-release-before-copy disclosures via RtlCopyToUser
• using leaked I/O ring RegBuffers/RegBuffersCount to pivot to arbitrary kernel R/W
• a short debug-indicator block
• an internal pointer to the existing token-theft page

Also updated the file’s References section with:

• the provided blog post
• the I/O ring primitive article

No new file was created.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://dungnm.hashnode.dev/pwn2own-with-microslop

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Windows Local Privilege Escalation > Kernel Race Conditions and Use-After-Free; cross-reference Binary Exploitation > Common Exploiting Problems and the existing Windows I/O ring/kernel arbitrary read-write material".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge