CVE-2021-31956General(microsoft / windows_10_1507)

CVE-2021-31956 is a Windows kernel privilege escalation vulnerability in NTFS ("ntfs.sys") caused by an integer underflow while processing Extended Attributes (EA). The resulting paged pool corruption can be turned into arbitrary kernel read/write primitives. What makes NCC Group's research particularly interesting is that it demonstrates exploitation without relying on the CVE-2021-31955 kernel address leak. Instead, it leverages the Windows Notification Framework (WNF) to build reliable exploitation primitives, making it an excellent study of NTFS internals, WNF, kernel pool corruption, and modern Windows exploit development.

CVE-2021-31956 is a Windows kernel privilege escalation vulnerability in NTFS. The vulnerability was caused by improper handling of objects in memory, allowing a local attacker to elevate privileges to SYSTEM. It was exploited in the wild and later analyzed in depth by Google Project Zero, making it an excellent case study for NTFS internals, kernel pool allocations, patch diffing, and modern Windows kernel exploitation.

One of the most interesting Windows NT kernel bugs is CVE-2021-31956 - https://www.sentinelone.com/vulnerability-database/cve-2021-31956/ The exploit targets the Windows NTFS driver by abusing a heap overflow to corrupt adjacent kernel objects. By carefully shaping the kernel heap, attackers turn the overflow into an arbitrary read/write primitive and eventually steal the SYSTEM token from another process.

https://www.nccgroup.com/research/cve-2021-31956-exploiting-the-windows-kernel-ntfs-with-wnf-part-2/