Talos Vulnerability Report

Summary

An out-of-bounds read vulnerability exists in the IppQualifyAddresses function of the Microsoft Windows tcpip.sys driver. A specially crafted I/O request packet (IRP) can cause an arbitrary out-of-bounds read, potentially leading to information disclosure or a denial-of-service condition.

Confirmed Vulnerable Versions

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

TCP/IP Driver (version(s): 10.0.26100.8457)

Product URLs

TCP/IP Driver - https://www.microsoft.com/

CVSSv3 Score

8.4 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

CWE

CWE-125 - Out-of-bounds Read

Details

Windows tcpip.sys is a core kernel-mode networking driver that implements major parts of the IPv4/IPv6 TCP/IP stack, including IP, TCP, UDP, ICMP, routing, and packet handling logic. It works with NDIS miniport drivers, filter drivers, WFP, Winsock/AFD, and other networking components to move network traffic between applications and network adapters.

When a specially crafted IRP request is sent to the handler for the 0x120007 IOCTL, it invokes the IpGetAllSortedAddressParameters function. fffff8055387cf20 uint64_t IpGetAllSortedAddressParameters(void* arg1)

fffff8055387cf20    {
fffff8055387cf20        int32_t* KeyBuffer = *(uint64_t*)((char*)arg1 + 0x10); //<---------- (1)
fffff8055387cf3a        uint128_t* rsi = *(uint64_t*)((char*)arg1 + 0x38);
fffff8055387cf3a        
fffff8055387cf3e        if (!Ipv6Global)
fffff8055387cf63            return 0xc00000bb;
fffff8055387cf63        
[...]

fffff8055387cffb        if (!*(uint32_t*)KeyBuffer || rax_5)
fffff8055387cffb        {
fffff8055387cf93            memset(rsi, 0, 0x4658);
fffff8055387cfdb            rbx = IppCreateSortedAddressPairsEx(rax_1, KeyBuffer[0xdae], rsi, 
fffff8055387cfdb                &rsi[0x36b], &KeyBuffer[1], KeyBuffer[0xdad], 
fffff8055387cfdb                (char*)rsi + 0x36b4, (char*)rsi + 0x4654);  //<-------------- (2)
fffff8055387cffb        }

At (1), the user-controlled input buffer, KeyBuffer, is read. The size of KeyBuffer is 0x36bc bytes. Later, at (2), the IppCreateSortedAddressPairsEx function is called. The second, fourth, and fifth arguments are derived from the KeyBuffer buffer. For this vulnerability, the fifth argument, MaxDestCount, is important.

fffff8055387d075        int32_t MaxDestCount_1 = MaxDestCount;
fffff8055387d079        int64_t P_2 = 0;
fffff8055387d07d        *(uint32_t*)arg4 = 0;
fffff8055387d083        int32_t rbx;
fffff8055387d083        
fffff8055387d083        if (!MaxDestCount) //<--------------  (3)
fffff8055387d120            rbx = 0;
fffff8055387d083        else
fffff8055387d083        {
fffff8055387d092            int64_t* rax_1 = IppFindCompartmentById(&Ipv4Global, *(uint32_t*)rdi);
fffff8055387d0a9            rsi = rax_1;
fffff8055387d0ac            IppQualifyAddresses(rdi, &MaxDestCount_1, keybuf_off4, nullptr); //<--------------  (4)
fffff8055387d0bf            int32_t rax_2;

In IppCreateSortedAddressPairsEx, if MaxDestCount is non-zero, then IppQualifyAddresses is called at (4) to filter the destination addresses. The KeyBuffer pointer is incremented by 4 bytes and passed to the IppQualifyAddresses function. fffff8055387d800 int32_t* IppQualifyAddresses(int64_t* arg1, int32_t* MaxDestCount, fffff8055387d800 void* keybuf_off4, void* const arg4)

fffff8055387d800    {
fffff8055387d800        int32_t* result = MaxDestCount;
fffff8055387d821        uint64_t MaxDestCount_1 = (uint64_t)*(uint32_t*)MaxDestCount;
[...]

fffff8055387d83b        
fffff8055387d841        if ((uint32_t)MaxDestCount_1)
fffff8055387d841        {
fffff8055387d843            char* r8 = (char*)keybuf_off4 + 9;
fffff8055387d843            
fffff8055387d871            do //<--------------  (5)
fffff8055387d871            {
fffff8055387d850                char rcx = r8[-1];
fffff8055387d850                
fffff8055387d858                if (rcx == 0xfe)
fffff8055387d858                {
fffff8055387d912                    if ((*(uint8_t*)r8 & 0xc0) != 0xc0)
fffff8055387d912                    {
fffff8055387d97d                        if (rcx == 0xfe && (*(uint8_t*)r8 & 0xc0) == 0x80)
fffff8055387d97d                        {
fffff8055387d987                            r15 = (uint64_t)(uint8_t)r15;
fffff8055387d987                                              
[...]
fffff8055387d858                }
fffff8055387d858                
fffff8055387d867                i += 1;
fffff8055387d86a                r8 = &r8[0x1c];
fffff8055387d871            } while (i < (uint32_t)MaxDestCount_1);  //<--------------  (6)
fffff8055387d841        }
fffff8055387d841        

The vulnerability occurs in IppQualifyAddresses. In IppQualifyAddresses, a loop starts at (5) and runs MaxDestCount times. It first increments KeyBuffer by 0x8, and in each iteration, KeyBuffer is increased by 0x1c. Therefore, if the value of MaxDestCount is greater than (0x36bc - 4 - 8) // 0x1c = 0x1f4, an out-of-bounds read occurs.

This can be observed while debugging the machine with WinDbg: : kd> g Breakpoint 0 hit tcpip!IppQualifyAddresses+0x21: fffff80724b2d821 448b32 mov r14d,dword ptr [rdx] 1: kd> r rax=ffffe40dc14878a0 rbx=ffffe40dc4b1e068 rcx=ffffe40dc14898a0 rdx=ffffce0b5f3a6c18 rsi=ffffe40dc14878a0 rdi=ffffe40dc14898a0 rip=fffff80724b2d821 rsp=ffffce0b5f3a6b80 rbp=ffffce0b5f3a6c48 r8=ffffe40dc4b1e06c r9=0000000000000000 r10=fffff80790ff9690 r11=ffffce0b5f3a6cc0 r12=0000000000000000 r13=00000000bbbbbbbb r14=0000000000000000 r15=fffff80724c963d8 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040282 tcpip!IppQualifyAddresses+0x21: fffff80724b2d821 448b32 mov r14d,dword ptr [rdx] ds:002b:ffffce0b5f3a6c18=bbbbbbbb;<--------- (7) 1: kd> p tcpip!IppQualifyAddresses+0x24: fffff80724b2d824 33f6 xor esi,esi 1: kd> p tcpip!IppQualifyAddresses+0x26: fffff80724b2d826 8b3d7c861200 mov edi,dword ptr [tcpip!scopeid_unspecified (fffff80724c55ea8)] 1: kd> p tcpip!IppQualifyAddresses+0x2c: fffff80724b2d82c 498be9 mov rbp,r9 1: kd> p tcpip!IppQualifyAddresses+0x2f: fffff80724b2d82f 4532c9 xor r9b,r9b 1: kd> p tcpip!IppQualifyAddresses+0x32: fffff80724b2d832 4532ff xor r15b,r15b 1: kd> p tcpip!IppQualifyAddresses+0x35: fffff80724b2d835 4d8be8 mov r13,r8 1: kd> p tcpip!IppQualifyAddresses+0x38: fffff80724b2d838 4c8be1 mov r12,rcx 1: kd> p tcpip!IppQualifyAddresses+0x3b: fffff80724b2d83b 448bd6 mov r10d,esi 1: kd> p tcpip!IppQualifyAddresses+0x3e: fffff80724b2d83e 4585f6 test r14d,r14d 1: kd> p tcpip!IppQualifyAddresses+0x41: fffff80724b2d841 7430 je tcpip!IppQualifyAddresses+0x73 (fffff80724b2d873) 1: kd> p tcpip!IppQualifyAddresses+0x43: fffff80724b2d843 4983c009 add r8,9 1: kd> p tcpip!IppQualifyAddresses+0x47: fffff80724b2d847 448d5e01 lea r11d,[rsi+1] 1: kd> p tcpip!IppQualifyAddresses+0x4b: fffff80724b2d84b 0f1f440000 nop dword ptr [rax+rax] 1: kd> p tcpip!IppQualifyAddresses+0x50: fffff80724b2d850 410fb648ff movzx ecx,byte ptr [r8-1] 1: kd> r rax=ffffe40dc14878a0 rbx=ffffe40dc4b1e068 rcx=ffffe40dc14898a0 rdx=ffffce0b5f3a6c18 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80724b2d850 rsp=ffffce0b5f3a6b80 rbp=0000000000000000 r8=ffffe40dc4b1e075 r9=0000000000000000 r10=0000000000000000 r11=0000000000000001 r12=ffffe40dc14898a0 r13=ffffe40dc4b1e06c r14=00000000bbbbbbbb r15=fffff80724c96300 iopl=0 nv up ei ng nz ac po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040292 tcpip!IppQualifyAddresses+0x50: fffff80724b2d850 410fb648ff movzx ecx,byte ptr [r8-1] ds:002b:ffffe40dc4b1e074=00 ; <------------- (8) 1: kd> db r8-c ffffe40dc4b1e069 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ……………. ffffe40dc4b1e079 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ ffffe40dc4b1e089 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ……………. ffffe40dc4b1e099 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ ffffe40dc4b1e0a9 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ……………. ffffe40dc4b1e0b9 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ ffffe40dc4b1e0c9 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ……………. ffffe40dc4b1e0d9 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1: kd> bp 1: kd> g Breakpoint 1 hit tcpip!IppQualifyAddresses+0x50: fffff80724b2d850 410fb648ff movzx ecx,byte ptr [r8-1] 1: kd> g Breakpoint 1 hit tcpip!IppQualifyAddresses+0x50: fffff80724b2d850 410fb648ff movzx ecx,byte ptr [r8-1] 1: kd> r rax=ffffe40dc14878a0 rbx=ffffe40dc4b1e068 rcx=0000000000000000 rdx=ffffce0b5f3a6c18 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80724b2d850 rsp=ffffce0b5f3a6b80 rbp=0000000000000000 r8=ffffe40dc4b1e0ad r9=0000000000000000 r10=0000000000000002 r11=0000000000000001 r12=ffffe40dc14898a0 r13=ffffe40dc4b1e06c r14=00000000bbbbbbbb r15=fffff80724c96300 iopl=0 nv up ei pl nz ac pe cy cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040217 tcpip!IppQualifyAddresses+0x50: fffff80724b2d850 410fb648ff movzx ecx,byte ptr [r8-1] ds:002b:ffffe40dc4b1e0ac=00 1: kd> u tcpip!IppQualifyAddresses+0x50: fffff80724b2d850 410fb648ff movzx ecx,byte ptr [r8-1] fffff80724b2d855 80f9fe cmp cl,0FEh fffff80724b2d858 0f84ac000000 je tcpip!IppQualifyAddresses+0x10a (fffff80724b2d90a) fffff80724b2d85e 4584c9 test r9b,r9b fffff80724b2d861 0f85bb000000 jne tcpip!IppQualifyAddresses+0x122 (fffff80724b2d922) fffff80724b2d867 41ffc2 inc r10d fffff80724b2d86a 4983c01c add r8,1Ch fffff80724b2d86e 453bd6 cmp r10d,r14d 1: kd> g Breakpoint 1 hit tcpip!IppQualifyAddresses+0x50: fffff80724b2d850 410fb648ff movzx ecx,byte ptr [r8-1]

In this case, the value of MaxDestCount is 0xbbbbbbbb, which can be observed at (7). The loop reads KeyBuffer at (8). Here, MaxDestCount is greater than 0x1f4, so if the loop continues, the following crash can be observed:

1: kd> g
KDTARGET: Refreshing KD connection

*** Fatal System Error: 0x00000050
                       (0xFFFFE40DC4B23014,0x0000000000000000,0xFFFFF80724B2D850,0x0000000000000002)

Driver at fault: 
***     tcpip.sys - Address FFFFF80724B2D850 base at FFFFF80724A70000, DateStamp 3fc564c3
.
Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

nt!DbgBreakPointWithStatus:
fffff807`910f92d0 cc              int     3


1: kd> !analyze -v -a
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffe40dc4b23014, memory referenced.
Arg2: 0000000000000000, X64: bit 0 set if the fault was due to a not-present PTE.
	bit 1 is set if the fault was due to a write, clear if a read.
	bit 3 is set if the processor decided the fault was due to a corrupted PTE.
	bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
	- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
	bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff80724b2d850, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------

*** WARNING: Unable to verify checksum for poc.exe
Unable to load image C:\Users\dev\Downloads\poc.exe, Win32 error 0n2
*** WARNING: Unable to verify checksum for poc.exe
Unable to load image C:\Users\dev\Downloads\poc.exe, Win32 error 0n2
*** WARNING: Unable to verify checksum for poc.exe
Unable to load image C:\Users\dev\Downloads\poc.exe, Win32 error 0n2

KEY_VALUES_STRING: 1

    Key  : AV.PTE
    Value: Invalid

    Key  : AV.Page.Virtual
    Value: 0xffffe40dc4b20000

    Key  : AV.Type
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 20421

    Key  : Analysis.Elapsed.mSec
    Value: 71615

    Key  : Analysis.IO.Other.Mb
    Value: 92

    Key  : Analysis.IO.Read.Mb
    Value: 34

    Key  : Analysis.IO.Write.Mb
    Value: 125

    Key  : Analysis.Init.CPU.mSec
    Value: 572390

    Key  : Analysis.Init.Elapsed.mSec
    Value: 109313545

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 255

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29547.1002

    Key  : Analysis.Version.Description
    Value: 10.2602.27.2 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2602.27.2

    Key  : Bugcheck.Code.KiBugCheckData
    Value: 0x50

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x50

    Key  : Bugcheck.Code.TargetModel
    Value: 0x50

    Key  : Failure.Bucket
    Value: AV_NETIO!NsiGetParameterEx

    Key  : Failure.Exception.IP.Address
    Value: 0xfffff80724b2d850

    Key  : Failure.Exception.IP.Module
    Value: tcpip

    Key  : Failure.Exception.IP.Offset
    Value: 0xbd850

    Key  : Failure.Hash
    Value: {144d820d-4433-7015-42ee-2ff721fb50d9}

    Key  : Faulting.IP.Type
    Value: Paged

    Key  : Hypervisor.Enlightenments.Value
    Value: 12576

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 0x3120

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 0

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 0

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 0

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 1

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 0

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 0

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 0

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 1

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 0

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 536632

    Key  : Hypervisor.Flags.ValueHex
    Value: 0x83038

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 0

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 0

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 0

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 0

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 0

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 0

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 0

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 0

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 0

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 0

    Key  : Hypervisor.RootFlags.Value
    Value: 0

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 0x0

    Key  : SecureKernel.HalpHvciEnabled
    Value: 0

    Key  : WER.OS.Branch
    Value: ge_release

    Key  : WER.OS.Version
    Value: 10.0.26100.1


BUGCHECK_CODE:  50

BUGCHECK_P1: ffffe40dc4b23014

BUGCHECK_P2: 0

BUGCHECK_P3: fffff80724b2d850

BUGCHECK_P4: 2

FAULTING_THREAD:  ffffe40dc4bc6080

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffe40dc4b23014

READ_ADDRESS:  ffffe40dc4b23014 Nonpaged pool

MM_INTERNAL_CODE:  2

PROCESS_NAME:  poc.exe

IP_IN_PAGED_CODE: 
tcpip!IppQualifyAddresses+50
fffff807`24b2d850 410fb648ff      movzx   ecx,byte ptr [r8-1]

STACK_TEXT:  
*** WARNING: Unable to verify checksum for poc.exe
Unable to load image C:\Users\dev\Downloads\poc.exe, Win32 error 0n2
ffffce0b`5f3a5f58 fffff807`911afa92     : ffffce0b`5f3a5fd8 00000000`00000001 00000000`00000080 fffff807`912c2a01 : nt!DbgBreakPointWithStatus
ffffce0b`5f3a5f60 fffff807`911aefbe     : 00000000`00000003 ffffce0b`5f3a60c0 fffff807`912c2c90 ffffce0b`5f3a6680 : nt!KiBugCheckDebugBreak+0x12
ffffce0b`5f3a5fc0 fffff807`910f8557     : 00000000`00000000 fffff807`90f0caf2 ffffe40d`c4b23014 00000000`00000000 : nt!KeBugCheck2+0xb2e
ffffce0b`5f3a6750 fffff807`90f0e960     : 00000000`00000050 ffffe40d`c4b23014 00000000`00000000 ffffce0b`5f3a69f0 : nt!KeBugCheckEx+0x107
ffffce0b`5f3a6790 fffff807`90e43e96     : 00000000`00000000 ffff8000`00000000 ffffe40d`c4b23014 0000007f`fffffff8 : nt!MiSystemFault+0x850
ffffce0b`5f3a6880 fffff807`912b80cb     : 004e005c`00000000 00000000`00000006 00000000`00000000 ffffce0b`5f3a6a70 : nt!MmAccessFault+0x646
ffffce0b`5f3a69f0 fffff807`24b2d850     : 00000000`00000015 ffffce0b`5f3a74a0 fffff807`249d4d60 00000000`00000015 : nt!KiPageFault+0x38b
ffffce0b`5f3a6b80 fffff807`24b2d0b1     : ffffe40d`c4b1e068 ffffce0b`5f3a6c18 ffffce0b`5f3a6c48 ffffe40d`c14878a0 : tcpip!IppQualifyAddresses+0x50
ffffce0b`5f3a6bd0 fffff807`24b2cfdb     : ffffe40d`c14898a0 ffffce0b`000000aa ffffe40d`c4b19000 ffffe40d`c4b1c6b0 : tcpip!IppCreateSortedAddressPairsEx+0x91
ffffce0b`5f3a6c90 fffff807`2496be03     : 00000000`00004658 00000000`00004658 00000000`00004658 ffffe40d`c4b1e000 : tcpip!IpGetAllSortedAddressParameters+0xbb
ffffce0b`5f3a6ce0 fffff807`25b32faa     : 000001f1`0e2b5fd0 ffffe40d`c4b1e000 00000000`00000000 000001f1`0e2b5fd0 : NETIO!NsiGetParameterEx+0x603
ffffce0b`5f3a6e50 fffff807`25b32968     : 00000000`00000000 ffffe40d`c3189440 ffffe40d`c3189370 000001f1`0e2b5fd0 : nsiproxy!NsippGetParameter+0x2aa
ffffce0b`5f3a6fe0 fffff807`90e5ccfb     : ffffce0b`5f3a7110 00000000`00000002 00000000`00000000 00000000`00000001 : nsiproxy!NsippDispatch+0xd8
ffffce0b`5f3a7030 fffff807`90e5cc73     : ffffce0b`5f3a70b0 ffffe40d`c4bc6910 00000000`00000000 ffffe40d`c4bc6958 : nt!IopfCallDriver+0x5b
ffffce0b`5f3a7070 fffff807`914cb3a5     : ffffe40d`c5e258d0 ffffce0b`5f3a7110 ffffe40d`c1795060 00000000`00000000 : nt!IofCallDriver+0x13
ffffce0b`5f3a70a0 fffff807`914ca1ec     : 00000000`00000001 00000000`00000001 00000000`00000001 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c5
ffffce0b`5f3a7150 fffff807`914c983e     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x99c
ffffce0b`5f3a73c0 fffff807`912bc555     : 00000000`00000001 000000a7`b08fa4c0 ffffce0b`5f3a7520 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
ffffce0b`5f3a7430 00007ff8`ea141d84     : 00007ff8`e7635c43 000000a7`b08fc038 000000a7`b08fc040 000000a7`b08fc048 : nt!KiSystemServiceCopyEnd+0x25
000000a7`b08fbfe8 00007ff8`e7635c43     : 000000a7`b08fc038 000000a7`b08fc040 000000a7`b08fc048 0000df38`66e83860 : ntdll!NtDeviceIoControlFile+0x14
000000a7`b08fbff0 00007ff8`e7d83335     : 00000000`00120007 00007ff6`63571531 00007ff6`63591298 00007ff6`63591128 : KERNELBASE!DeviceIoControl+0x73
000000a7`b08fc060 00007ff6`63571424     : 000001f1`0e2b0020 000001f1`0e040000 00000000`00000000 00000000`00000000 : KERNEL32!DeviceIoControlImplementation+0x75
000000a7`b08fc0b0 000001f1`0e2b0020     : 000001f1`0e040000 00000000`00000000 00000000`00000000 00000000`00000000 : poc+0x1424
000000a7`b08fc0b8 000001f1`0e040000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000001f1`0e2b0020
000000a7`b08fc0c0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 000000a7`b08fc118 : 0x000001f1`0e040000


SYMBOL_NAME:  NETIO!NsiGetParameterEx+603

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

STACK_COMMAND: .process /r /p 0xffffe40dc4ac3080; .thread /r /p 0xffffe40dc4bc6080 ; kb

BUCKET_ID_FUNC_OFFSET:  603

FAILURE_BUCKET_ID:  AV_NETIO!NsiGetParameterEx

OS_VERSION:  10.0.26100.1

BUILDLAB_STR:  ge_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {144d820d-4433-7015-42ee-2ff721fb50d9}

Followup:     MachineOwner
---------


kd>lmDvm tcpip
Browse full module list
start             end                 module name
fffff807`24a70000 fffff807`24dc9000   tcpip      (pdb symbols)          C:\ProgramData\Dbg\sym\tcpip.pdb\D6947ED1ADE91B23FA5AFE8178A2AF0F1\tcpip.pdb
    Loaded symbol image file: tcpip.sys
    Image path: \SystemRoot\System32\drivers\tcpip.sys
    Image name: tcpip.sys
    Browse all global symbols  functions  data  Symbol Reload
    Image was built with /Brepro flag.
    Timestamp:        3FC564C3 (This is a reproducible build file hash, not a timestamp)
    CheckSum:         00354B4C
    ImageSize:        00359000
    Mapping Form:     Loaded
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

Vendor Response (CVE-2026-49177)

Vendor Link: https://windowsforum.com/security-alerts.84/cve-2026-49177-july-14-updates-fix-windows-tcp-ip-data-leak.438177/

Timeline

2026-06-01 - Vendor Disclosure
2026-07-14 - Vendor Patch Release