Frame by Frame, Kernel Streaming Keeps Giving Vulnerabilities

Frame by Frame, Kernel Streaming Keeps Giving Vulnerabilities

Speaker: Angelboy (DEVCORE)

Conference: OffensiveCon 2025 — May 16–17, 2025, Berlin

YouTube: https://www.youtube.com/watch?v=rHyFnkrJ3Ws

Reading time: ~10 minutes

TL;DR

Angelboy of DEVCORE uncovered more than 20 vulnerabilities in Windows Kernel Streaming (KS), concentrated in the AVStream subsystem used by webcams and video devices. By abusing a logic inversion in how the 32-bit compatibility shim (KsThunk) and the core KS library handle MDL (Memory Descriptor List) cache flags, an attacker can corrupt kernel memory through mismatched frame-buffer mappings. The research culminates in a novel MDL-spray technique that achieves arbitrary physical memory writes and full kernel-level code execution on Windows 11 24H2.

Introduction

Windows Kernel Streaming is the multimedia plumbing that quietly activates whenever a user opens a webcam or audio device. Because it bridges user-mode requests to hardware drivers — and handles raw physical memory through MDLs — it is a privileged but often overlooked attack surface. At OffensiveCon 2025, Angelboy presented the continuation of DEVCORE's multi-year audit of this subsystem. Where a prior round of research (presented at HackSACon 2024) surfaced dozens of out-of-bounds and "pass-through-to-kernel" bugs (including a Pwn2Own exploit), this talk reveals an entirely new stratum: frame-handling bugs in AVStream that arise not from simple bounds failures but from subtle behavioral inversions between two different kernel components.

The novelty here is structural: fourteen of the twenty-plus bugs found reside in AVStream's frame lifecycle, and the exploit chain does not rely on heap spray or race conditions in the traditional sense. Instead, it weaponizes the kernel's own MDL infrastructure as a spray mechanism, turning a memory-mapping primitive into an arbitrary physical write capability.

Background: Windows Kernel Streaming Architecture

▶ Watch: KS Architecture Overview (0:00)

Kernel Streaming exposes three multimedia driver models: PortClass (audio), AVStream (video/webcam), and the older Stream class. From a user-mode program's perspective, interaction flows through Setup DI APIs to enumerate devices, then through IOCTL calls against KS filter and pin objects. A KS filter represents a device function; a KS pin is the read/write endpoint.

The two most security-relevant components in the pipeline are:

• KsThunk — the WOW64 thunk layer that converts 32-bit IOCTL requests into 64-bit equivalents before passing them to the core KS library.
• ks.sys — the core KS library that handles IOCTL_KS_PROPERTY dispatch, AVStream pin state management, and frame allocation.

▶ Watch: KS Filter and Pin Explanation (2:00)

When an application reads a frame from a webcam, it supplies a KSSTREAM_HEADER structure containing a user-space buffer address and buffer size. KS allocates an MDL against this buffer, maps it into kernel space, links it to a KS frame structure, and queues the frame for the driver worker thread to fill. Because both the user-space buffer and the kernel frame buffer point to the same physical memory, image data written by the driver is instantly visible in user space. Multiple frames can be submitted simultaneously by providing an array of KSSTREAM_HEADER entries; KS builds an MDL chain accordingly.

CVE-2024-30090 and the Pass-Through-to-Kernel Class

▶ Watch: Pass-Through-to-Kernel Bugs (6:00)

Before diving into the new bug classes, Angelboy briefly reviewed the prior year's "pass-through-to-kernel" vulnerability class (the technique used at Pwn2Own 2024). When an IOCTL originates in user mode, its IRP carries RequestMode = UserMode and all inputs are validated. However, if a kernel driver internally re-issues an IOCTL using user-controlled data, the new IRP carries RequestMode = KernelMode, bypassing validation.

In the specific case of CVE-2024-30090, the user-supplied address was passed directly as a kernel aperture pointer under kernel-mode IRP conditions, enabling arbitrary memory read/write. This served as the foundation motivating a deeper dive into AVStream's frame-handling mechanics, where Angelboy and DEVCORE expected — and found — richer classes of bugs.

Bug Class 1: MDL Mismatch via Cache Flag Inversion

▶ Watch: MDL Mismatch Bug Class (14:01)

The most structurally interesting new bug class Angelboy named "MDL mismatch." It arises from a behavioral inversion between KsThunk and ks.sys when processing multi-frame requests submitted from a 32-bit (WOW64) process.

When KsThunk receives a 32-bit streaming request, it pre-allocates MDLs for the frame buffers before forwarding the IRP to ks.sys. The allocation logic is controlled by an option flag in the KSSTREAM_HEADER: when bit 0x8000 is set, KsThunk skips MDL allocation (treating the frame as a cache-hit case). When ks.sys later processes the same IRP, its logic for the same flag is reversed — if 0x8000 is set, ks.sys allocates an MDL; if it is clear, ks.sys assumes KsThunk already allocated one.

▶ Watch: MDL Chain Abuse Example (16:01)

By submitting two frames with strategically mismatched cache flags — for example, Frame 1 with 0x8000 set and a size of 0x1000, Frame 2 without the flag and a size of 0x20000 — an attacker causes:

• KsThunk to allocate an MDL for Frame 2 (size 0x20000), skip Frame 1.
• ks.sys to allocate an MDL for Frame 1 (size 0x1000), skip Frame 2.

The resulting MDL chain is threaded into KS frame structures in header order. Frame 1's KS frame (which stores size = 0x1000) receives the MDL sized for 0x20000, and Frame 2's KS frame (which stores size = 0x20000) receives the MDL sized for 0x1000. The driver worker then writes up to 0x20000 bytes into the smaller physical buffer — an out-of-bounds write into physical memory contiguous with that buffer.

▶ Watch: MDL Mismatch Root Cause (18:00)

The immediate trigger crashes the system with a BSOD, but it establishes the corruption primitive. The root cause is that each component independently applies contradictory interpretations of the same flag without any cross-check.

Bug Class 2: Frame Buffer Misalignment

A second new bug class involves frame buffer misalignment during 32-to-64-bit conversion in KsThunk. During the thunk conversion of multi-frame requests, user-controlled header data can produce situations where the virtual-to-physical mapping for a frame buffer is established against a misaligned user-space address. Under specific alignment conditions, the MDL describes a physical page that partially overlaps adjacent kernel allocations, again enabling out-of-bounds writes when the device fills the frame.

Angelboy noted that this class is distinct from MDL mismatch because it does not require the cache flag inversion — it affects any 32-bit process that submits carefully crafted buffer addresses. The misalignment bug is representative of a broader pattern: KsThunk and ks.sys jointly own an implicit contract about how user-supplied buffer geometry translates to physical mappings, and neither component fully validates that contract on its own.

Exploitation: MDL Spray for Arbitrary Physical Memory Writes

▶ Watch: Exploitation Technique Overview (20:00)

The most significant contribution of the talk is the exploitation path from these corruption primitives to arbitrary physical memory writes on Windows 11 24H2. The technique, which Angelboy termed the MDL spray, works as follows:

1. Trigger MDL mismatch at scale. Submit a large number of multi-frame requests with the mismatched flag pattern. Each request causes ks.sys to create a KS frame whose stored size exceeds the actual size of its paired MDL. The oversized-size KS frames are queued across the heap.

1. Control adjacent physical pages. Because MDLs track the physical page layout of frame buffers, the attacker can control which physical pages the enlarged-size frame believes it covers by carefully choosing user-space buffer addresses that map to predictable physical regions (e.g., by exploiting the Windows page file or by allocating a large number of user-space buffers to exhaust randomization).

1. Trigger device fill. Set the pin to run state and allow the device worker to fill frames from the queue. The worker uses the KS frame's stored (oversized) size, writing beyond the end of the legitimate physical buffer and into adjacent physical memory.

1. Overwrite a kernel target. By placing a high-value kernel structure — such as a page table entry or a token pointer in a SYSTEM process's _EPROCESS — at the adjacent physical address, the fill operation overwrites it with controlled data (the "image data" fabricated by a mock device or by driving the webcam through a V4L-compatible interface).

The full exploit achieves kernel-level code execution on a fully patched Windows 11 24H2 system, bypassing Supervisor Mode Execution Prevention (SMEP) and Kernel Data Protection (KDP) where applicable to the targeted structures.

Notable Quotes

"More and more vulnerabilities are streaming out, and many of them are exploitable."

— Angelboy, ▶ 0:00

"The root cause of this issue is a mismatch between the KAS STREAM header and its corresponding MDL for each frame. The first KAS STREAM header might get paired with the MDL for the second frame, while the second KAS STREAM header gets linked to the MDL of the first frame."

— Angelboy, ▶ 18:00

"If the request mode is set to kernel mode, no validation is performed. The data provided by the user is directly used as a function code, leading to arbitrary code."

— Angelboy, ▶ 6:00

Key Takeaways

• AVStream is a high-density bug surface. Of 20+ bugs found in Kernel Streaming, 14 are in AVStream's frame-handling path, and most of those are exploitable — not merely informational or low-severity crashes.
• Component boundary inconsistencies are a class, not a quirk. The MDL mismatch bug exists because KsThunk and ks.sys apply opposite logic to the same flag without coordination. Any such boundary where two components independently interpret a shared state field is worth auditing for inversion bugs.
• CVE-2024-30090 is just the surface. Prior Pwn2Own exploits from DEVCORE only scratched the outer layer of KS bugs; the deeper frame-handling interior had not been systematically reviewed.
• MDL primitives are exploitable beyond the kernel. Using the MDL infrastructure as a spray mechanism to achieve arbitrary physical memory writes is a transferable technique applicable wherever MDLs manage user-supplied buffers at the intersection of a thunk layer and a driver.
• Windows 11 24H2 is fully exploitable via this path. The full exploit chain demonstrated in this talk achieves kernel code execution on a current, fully patched release, underscoring the need for Microsoft to audit the entire KS frame-processing pipeline.