cve-2025-21333 - 1day breakdown

Author: ghostbyt3

content/1day-breakdowns/cve-2025-21333.md

@@ -13,15 +13,13 @@ layout: "single"
 showTableOfContents: true
 ---
 
+A vulnerability in the Windows Hyper-V NT Kernel Integration VSP driver exists due to a vulnerable function, `VkiRootAdjustSecurityDescriptorForVmwp()`, which can be invoked from user mode. This leads to a heap-based buffer overflow, ultimately resulting in privilege escalation.
+
 **CVE-2025-21333:** https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21333  
 **Vulnerability Type:** Heap-based Buffer Overflow  
 **Tested On:** Windows 11 23H2  
 **Driver Version:** vkrnlintvsp.sys - 10.0.22621.2506  
 
-## Description
-
-A vulnerability in the Windows Hyper-V NT Kernel Integration VSP driver exists due to a vulnerable function, `VkiRootAdjustSecurityDescriptorForVmwp()`, which can be invoked from user mode. This leads to a heap-based buffer overflow, ultimately resulting in privilege escalation.
-
 ## Requirements
 
 To exploit this vulnerability, Windows Sandbox must be enabled in "Turn Windows features on or off". 
@@ -135,14 +133,7 @@ The kernel has a mechanism to register and use specific callbacks for some prede
 
 In this case, it was discovered that `VkiRootCalloutCreateEvent()` is one of the callback functions that can be invoked by `NtCreateCrossVmEvent()`. Therefore, to reach the vulnerable function call, we need to invoke `NtCreateCrossVmEvent()` from user space.
 
-```mermaid
-flowchart LR
-%%{init: {"flowchart": {"htmlLabels": false}} }%%
-A["NtCreateCrossVmEvent (ntdll.dll)"] 
---> B["ExpCreateCrossVmEvent (ntoskrnl.exe)"] 
---> C["VkiRootCalloutCreateEvent (vkrnlintvsp.sys)"] 
---> D["VkiRootAdjustSecurityDescriptorForVmwp (vkrnlintvsp.sys)"]
-```
+![IMG](/img/cve-2025-21333/img2.png)
 
 `NtCreateCrossVmEvent()` is an undocumented function that takes an `OBJECT_ATTRIBUTES` structure as an argument. This structure includes a `SecurityDescriptor` (`SECURITY_DESCRIPTOR`), which contains the security information associated with the object — including the `Dacl`. This is where the payload should be injected in order to trigger the vulnerability.
 ```c++