Escalating a Windows driver registry bug to a kernel write primitive
Summary: Trail of Bits walked through a Windows driver registry handler that calls RtlQueryRegistryValues with RTL_QUERY_REGISTRY_DIRECT set but without RTL_QUERY_REGISTRY_TYPECHECK, letting a REG_QWORD MajorVersion value overwrite four bytes past a stack integer. Because Windows 8 and later bugcheck untrusted hives in that configuration, the authors pivoted to trusted system hives, where Get-AccessibleKey found writable keys including \REGISTRY\MACHINE\SOFTWARE\Microsoft\DRM and the PlayReady\Troubleshooter key, the latter granting Full Control to Users and restricted app packages.
Key Takeaway: The protective bugcheck that turned this into a local denial of service was added in response to MS11-011, yet writable keys inside trusted system hives still let a low-integrity process plant a REG_QWORD that can overwrite half of an adjacent function pointer.
Read the original at Trail of Bits Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026