Hunting for Overlooked Cookies in Windows 11 KTM and Baking Exploits for Them

Hunting for Overlooked Cookies in Windows 11 KTM and Baking Exploits for Them

Speakers: Jael Koh (PixiePoint Security), Cedric Halbronn (eSec Lab)

Conference: OffensiveCon 2025 — May 16–17, 2025, Berlin

YouTube: https://www.youtube.com/watch?v=goEb7eKj660

Reading time: ~9 minutes

TL;DR

Jael Koh, a researcher at PixiePoint Security, discovered two Use-After-Free vulnerabilities in the Windows Kernel Transaction Manager (KTM) driver within three weeks of focused investigation — targeting two previously undocumented kernel object types identified only as "cookie five" and "cookie six." Both vulnerabilities were patched by Microsoft in the October 2024 Patch Tuesday update as CVE-2024-43570 and CVE-2024-43535. The talk, co-presented with Cedric Halbronn of eSec Lab, walks through the discovery methodology and the exploitation challenges specific to Windows 11.

Introduction

The Windows Kernel Transaction Manager has been an active — if underappreciated — attack surface since Windows Vista. While Win32k received the bulk of research attention through the 2010s, KTM offered a quieter path to kernel-level code execution that was accessible even from sandboxed processes. The 2018 in-the-wild exploit (CVE-2018-8611), which Halbronn and a colleague later reverse-engineered and recreated, demonstrated that KTM could be weaponized as a sandbox escape when Win32k APIs were blocked.

What makes Koh's research distinctive is not just the vulnerabilities themselves, but the methodology: finding previously uncharted kernel objects by examining undocumented object type cookies in IDA Free, then building deep understanding of those objects before looking for security flaws. The result — two UAF vulnerabilities discovered within three weeks — shows that systematic exploration of overlooked kernel subsystems remains one of the most productive paths in Windows kernel research.

KTM's Object Model: Four Known, Two Hidden

▶ Watch: KTM Object Model (2:00)

KTM exposes four documented kernel object types to userland: the Transaction Manager (TM), the Resource Manager (RM), the Transaction, and the Enlistment. Each object maintains defined relationships — a transaction holds a linked list of enlistments, and a resource manager maintains its own linked list of enlistments from potentially different transactions. These four objects each carry an internal type cookie (cookies one through four) used by the kernel to validate object types before operating on them.

During Cedric Halbronn's 2024 KTM training course — itself built on the 2018 CVE-2018-8611 exploit recreation — Koh noticed the internal KTM cookie table had entries for cookie five and cookie six that pointed to types not covered in any public research or documentation. The table labels identified them as a "protocol address information object" and a "propagate request object."

A quick Google search for the numeric value of cookie five returned nothing useful. A text search in IDA Free on the KTM driver returned exactly one hit: TmRegisterProtocolAddressInformationExt — a syscall wrapping the protocol object's allocation and initialization. That single result became the starting point for several weeks of manual reverse engineering.

Reversing the Undocumented Objects

▶ Watch: Cookie Five Discovery (8:00)

Koh describes the methodology as deliberately non-adversarial: rather than looking for vulnerabilities, the goal was to understand what these objects do, how they are created, and what the programmer who wrote them intended. The approach echoes a philosophy articulated in a talk by Satoshi Tanda titled "Do Not Find Bugs, Bugs Will Find You."

Cookie five — the Protocol object: A protocol is created by calling NtRegisterProtocolAddressInformationExt on a resource manager's handle. The function allocates the protocol object, assigns it a caller-supplied GUID, and inserts it into the resource manager's ProtocolListHead linked list. One important subtype is the promoting protocol: a protocol that carries a specific hard-coded static GUID, distinguishing it from ordinary protocols. This promoting protocol plays a central role in the transaction promotion workflow.

Cookie six — the Propagate Request object: A propagate request is allocated and initialized when a transaction undergoes transaction promotion, handled by TmpAllocatePropagateRequest. Unlike the protocol object, the propagate request's resource manager field starts as null. After allocation, the propagate request is dispatched through TmpDispatchPropagateRequest.

▶ Watch: Cookie Six and Propagate Request (12:00)

Koh spent roughly a week reversing each object, annotating assembly blocks in IDA, and writing proof-of-concept code to exercise the functions before any vulnerability hypothesis was formed. Ten initial ideas for potential vulnerabilities were tested. All ten failed.

The Use-After-Free in CVE-2024-43535 (Cookie Six / Propagate Request)

▶ Watch: UAF Vulnerability (12:01)

The breakthrough came not at a workstation but on an elliptical trainer. The idea: free one object while another is concurrently using it. Specifically, Koh asked — what happens if the promoting protocol is freed in the window between TmpDispatchPropagateRequest finding the promoting protocol and reading its resource manager field?

The execution path within TmpDispatchPropagateRequest is:

1. Find the promoting protocol (by searching the resource manager's ProtocolListHead for the static GUID).
2. Read the resource manager field of the promoting protocol.
3. Write that value to the resource manager field of the propagate request.
4. Use the resource manager in KeWaitForSingleObject, KeReleaseMutex, and TmpSetNotificationResourceManager.

The race window between steps 1 and 2 is exploitable because closing the user-mode handle to the resource manager triggers TmpCloseResourceManager, which calls TmpDeleteProtocol on every entry in the resource manager's protocol list, including the promoting protocol — freeing it. If an attacker races the close against the dispatch, the freed protocol's memory can be reclaimed with a named pipe segment, poisoning the resource manager field that TmpDispatchPropagateRequest then reads and propagates to the propagate request object. When the poisoned value is subsequently used in kernel APIs, attacker-controlled primitives become available.

The constraint is real: triggering TmpAllocatePropagateRequest requires a clustered disk, a disk configuration intended for high-availability scenarios rather than the basic disks found in typical laptops. This limits the exploit environment but does not eliminate it as a realistic attack scenario.

The Use-After-Free in CVE-2024-43570 (Cookie Five / Protocol)

▶ Watch: Cookie Five Vulnerability (10:00)

The first vulnerability Koh discovered — which produced the first-ever personally witnessed kernel BSOD — centers on the cookie five protocol object itself. The UAF condition arises when one thread frees a resource manager (and thus its associated protocol objects via TmpCloseResourceManager) while another thread is operating on those same protocols.

Because the protocol object is inserted into the resource manager's ProtocolListHead on creation but is freed without proper synchronization guards in the relevant code paths, a race condition allows the freed protocol memory to be reused before the referencing thread completes its operation. The ability to reclaim the freed pool allocation — and control its contents — yields kernel read/write primitives.

Microsoft assigned CVE-2024-43570 to this vulnerability, patching it alongside CVE-2024-43535 in the October 2024 Patch Tuesday release.

Exploitation Challenges on Windows 11

▶ Watch: Exploitation Approach (14:00)

Exploitation of both UAFs on Windows 11 is complicated by modern kernel hardening. The talk details the challenges of achieving reliable heap reclamation with named pipes to control the poisoned object's memory content, as well as techniques to stabilize the race window. Windows 11's segment heap allocator and the constraint that the cookie-six UAF requires a clustered disk both narrow the reliable exploit path.

Halbronn, who supervised and collaborated on the exploitation work, highlighted that the pair's decision to release a public training course on the 2018 CVE-2018-8611 exploit earlier in 2024 was indirectly what led to these discoveries — Koh attended that training, which is how the cookie table with entries five and six first came to attention.

The Research Mindset: Failure is the Default

▶ Watch: Research Philosophy (10:00)

A substantial portion of the talk is devoted to the psychological and practical reality of vulnerability research. Koh disclosed that this was actually the third attempt at reversing the KTM driver — two prior efforts failed and were never discussed publicly. The ten failed vulnerability ideas before the successful UAF hypothesis are documented in the slides not as embarrassments but as an honest account of what research actually looks like.

Koh frames vulnerability research as "playing baseball with no strikeouts": failures can accumulate silently while the researcher keeps swinging. The eventual success does not retroactively delegitimize the failures; it just ends the silence.

Notable Quotes

"KTM remains an accessible, complex, yet woefully unaudited attack surface to this day." — Jael Koh ▶ 0:00

"I wasn't looking for vulnerabilities. I didn't even know if this function was reachable. All I wanted to know was, what do these overlooked cookies do?" — Jael Koh ▶ 8:00

"This was actually my third time reversing the KTM driver. My first and second times both ended up in failure, and I just never bothered to tell anyone about it." — Jael Koh ▶ 10:00

Key Takeaways

• KTM's two undocumented object types — the protocol address information object (cookie five) and the propagate request object (cookie six) — contained Use-After-Free vulnerabilities that persisted unnoticed until Koh's 2024 research, despite KTM being an in-the-wild exploit target since 2018.
• CVE-2024-43570 (cookie five UAF) and CVE-2024-43535 (cookie six UAF) were both patched in Microsoft's October 2024 Patch Tuesday update; both expose kernel-level primitives reachable from unprivileged or sandboxed user-mode processes.
• The cookie-six UAF requires a clustered disk configuration to trigger, which narrows the attack surface but does not eliminate it in enterprise and server environments where clustered disks are standard.
• Exploitation on Windows 11 requires overcoming modern kernel heap hardening; the named-pipe reclaim technique is used to poison freed pool memory and control kernel object fields passed to KeWaitForSingleObject and KeReleaseMutex.
• The discovery reinforces a systematic research approach: deeply understand an undocumented subsystem first, without searching for bugs, and document failures honestly — the vulnerability will surface through understanding, not hunting.