Vulnerabilities Assembled! The Cross-Component Vulnerability Factory Inside the Windows Kernel
DAY 2
9:50-
10:30
As a fundamental part of the Windows networking stack, AFD (Ancillary Function Driver for Winsock) has undergone years of security hardening and is often considered a well-investigated target with a shrinking attack surface. But is that really true? By viewing AFD from a cross-layer composition perspective and combining drivers and components like LEGO blocks, we uncovered more than 30 vulnerabilities.
We introduce the concept of transport-layer gadgets and show how different transports, execution paths, and fragile assumptions can be combined to create entirely new bug classes. The resulting LPE primitives are stable, exploitable, and affect multiple generations of Windows. Under certain conditions, they can also break AppContainer isolation and enable practical sandbox escapes.
In this talk, we explain how this attack surface emerges, present representative case studies, and share guidelines for identifying similar composition-driven vulnerabilities across the Windows ecosystem.
-
Location :
-
Track 1(HALL B)
-
-
Category :
-
Technical
-
-
Share :
Speakers
-
Angelboy Yang
Angelboy・ヤン
An-Jie Yang, aka Angelboy, is a senior security researcher of DEVCORE and a member of CHROOT security group from Taiwan. He is a vulnerability researcher focusing on Windows-related security and was selected as one of the MSRC Most Valuable Security Researchers in 2024. He participated in a lot of CTF, such as HITB, DEFCON, Boston key party and won 2nd in DEFCON CTF 25/27 with HITCON CTF Team. In the past two years, he has pwned several products in Pwn2Own Mobile. He also won the title of the "Master of Pwn" at Pwn2Own Toronto 2022 with the DEVCORE team. He has spoken at several conferences such as HITCON, CODEBLUE, AVTokyo, HITB GSEC.
You can find him on Twitter @scwuaptx.