Home / os / winmobile

BlueKeep RDP Remote Windows Kernel Use-After-Free

Posted on 24 September 2019

The RDP termdd.sys driver improperly handles binds to internal-only channel MS_T120, allowing a malformed Disconnect Provider Indication message to cause a use-after-free. With a controllable data/size remote nonpaged pool spray, an indirect call gadget of the freed channel is used to achieve arbitrary code execution.

 

TOP