Windows 10 19H1+ pool overflow exploitation (Scoop the Pool)

Aynı teknik/bug: Win10 19H1+ segment-heap (kLFH) pool overflow'unda bitişik aynı-boyut victim object'i corrupt etmek. Canonical not: Non-paged pool overflow exploitation.

Mechanism

Bu, "Scoop the Pool" (Bayet/Fariello) genel stratejisinin canonical not'taki kLFH _POOL_HEADER + object-spray anlatımıyla aynı kök nedene dayanan write-up'ıdır: segment-heap kLFH'de aynı size-class'taki coalesce edilmeyen chunk'lar arasında lineer OOB write, bitişik bir victim object'i (size/length member ya da gömülü pointer) corrupt eder ve valid bir _POOL_HEADER korunur. Ayrıntı için non-paged-pool-overflow-exploitation.

Walkthrough

Tam walkthrough canonical not'ta: non-paged-pool-overflow-exploitation.

References

• Scoop the Windows 10 Pool! — Corentin Bayet & Paul Fariello, SSTIC 2020 (paper)
• Swimming In The (Kernel) Pool, Part 1 — Connor McGarr
• LFH Kernel Pool Allocator Challenges the Incumbent — OSR

See also

• non-paged-pool-overflow-exploitation.md
• kernel-low-fragmentation-heap-exploitation.md
• windows-notification-facility-arbitrary-r-w-primitive.md