Pig in a Poke: Automatically Detecting and Exploiting Link Following Vulnerabilities in Windows File Operations

Bocheng Xiang, Yuan Zhang, Fengyu Liu, Hao Huang, Zihan Lin, Min Yang

34th USENIX Security Symposium · Day 1

This article delves into the critical security research presented in "Pig in a Poke: Automatically Detecting and Exploiting Link Following Vulnerabilities in Windows File Operations." The paper introduces **Link Following Vulnerabilities (LFVulns)**, a significant class of security flaws in Windows systems stemming from the improper handling of symbolic links by privileged programs. These vulnerabilities allow low-privileged attackers to manipulate sensitive system files, leading to severe consequences such as Local Privilege Escalation (LPE) and Denial of Service (DoS). The research highlights that despite the widespread use of symbolic links, developers often overlook the necessary validation, creating a fertile ground for exploitation.

AI review

Solid systems security research that formalizes a messy vulnerability class, builds a working detection/exploitation pipeline, and proves it out with 55 zero-days across Microsoft, Apple, Intel, Tencent. The sink taxonomy and constraint-aware fuzzing are genuinely useful contributions. Not revolutionary—symlink abuse is old news—but the automation and scale of validation are what make this worth reading.