Windows Kernel Logic Bug Class: Access Mode Mismatch in IO Manager
Summary: Project Zero's James Forshaw documented a Windows kernel logic bug class in which the IO Manager's access mode handling can mismatch security access checking and memory access checking, with maximum impact of local privilege escalation if kernel and driver developers don't account for how the IO manager operates when accessing device objects. He found it while exploiting issue 779, a file TOCTOU that bypassed the custom font loading mitigation policy, where IoCreateFile failed with STATUS_OBJECT_NAME_NOT_FOUND because RtlIsSandboxedToken received AccessMode set to KernelMode.
Key Takeaway: The bug class turns on a single parameter, KPROCESSOR_MODE, where passing KernelMode makes SeAccessCheck pass automatically regardless of the caller's access token - so a driver that gets the mode wrong can hand a local user privilege escalation.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-3219
- Related
- A Shadow of our Former Self Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026