Description
Windows流式处理服务ksthunk.sys在处理IOCTL_KS_ENABLE_EVENT时，会进行32位到64位结构的转换，在转换过程中存在任意内核地址的内容加一的漏洞。利用这个漏洞，可以替换进程中SeDebugPrivilege权限位的值，导致低权限进程可以打开高权限进程，从而实现本地权限提升。
Windows流式处理服务ksthunk.sys提权漏洞（CVE-2024-30090）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30090
https://nvd.nist.gov/vuln/detail/CVE-2024-30090
https://devco.re/blog/2024/10/05/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part2-en/
https://github.com/Dor00tkit/CVE-2024-30090
https://ddpoc.com/DVB-2024-8641.html
https://www.rapid7.com/db/vulnerabilities/msft-cve-2024-30090/
https://ssd-disclosure.com/ssd-advisory-ksthunk-sys-integer-overflow-pe/
https://www.cvedetails.com/cve/CVE-2024-30090/