HTTP Protocol Stack Remote Code Execution Vulnerability
CVE-2021-31166 This is a proof of concept for CVE-2021-31166 (“HTTP Protocol Stack Remote Code Execution Vulnerability”), a use-after-free dereference in http.sys patched by Microsoft in May 2021. According to this tweet the vulnerability has been found by @_mxms and @fzzyhd1. The bug itself happens in http!UlpParseContentCoding where the function has a local LIST_ENTRY and appends item to it. When it’s done, it moves it into the Request structure; but it doesn’t NULL out the local list. The issue with that […]
Read more