Examining the Sym Crypt DoS Vulnerability
Summary: Tavis Ormandy disclosed a denial-of-service vulnerability in the SymCrypt library, affecting the function SymCryptFdefModInvGeneric in bcryptprimitives.dll, which enters an infinite loop on malformed input and hangs applications such as certutil.exe, possibly requiring a reboot. Dragos verified the user-mode loop in IDA Pro and found that cng.sys also exports SymCryptFdefModInvGeneric, with a kernel-mode implementation similar in structure to the user-mode one, though it was not tested for the same flaw.
What you should know: Because bcryptprimitives is a shared Windows API, the bug can hang any third-party software that calls it, not just Microsoft code - and if the kernel-mode cng.sys version carries the same flaw, a driver-level denial of service could cascade across the operating system.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026