Windows Drivers are True’ly Tricky

A look at the Android kernel driver attack surface, summarizing research progress, recurring bug classes, and directions for hardening and future driver security work.

A Project Zero post explains how arbitrary file write bugs on Windows can be turned into local privilege escalation, walking through practical exploitation techniques for this bug class.

A Project Zero post on using binary patch diffing to uncover Windows kernel memory disclosure bugs, including methodology, tooling, and notable findings from this approach.

A Project Zero post in the Windows exploitation tricks series, showing how an arbitrary directory creation primitive can be escalated into arbitrary file read.

A Project Zero post on attacking NVIDIA's Windows kernel graphics driver, covering several of the 16 vulnerabilities found during this GPU attack surface research.

A Project Zero deep dive into a design flaw around task_t in the XNU kernel, demonstrating sandbox escapes and privilege escalation and how each mitigation was defeated.