cve-2025-21333 - 1day breakdown

Author: ghostbyt3

content/1day-breakdowns/cve-2025-21333.md

@@ -15,7 +15,7 @@ showTableOfContents: true
 
 **CVE-2025-21333:** https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21333  
 **Vulnerability Type:** Heap-based Buffer Overflow  
-**Tested On:** Windows 11 23H2
+**Tested On:** Windows 11 23H2  
 **Driver Version:** vkrnlintvsp.sys - 10.0.22621.2506  
 
 ## Description
@@ -131,9 +131,34 @@ LABEL_16:
 }
 ```
 
+The kernel has a mechanism to register and use specific callbacks for some predetermined drivers. When the specific driver gets loaded, the driver provides a table which contains list of callbacks that the kernel can use. During the initialization, the kernel calls `ExRegisterHost()` function with some specific inputs this is specific for each driver to register some predetermined unexported functions. 
+
+In this case, it was discovered that `VkiRootCalloutCreateEvent()` is one of the callback functions that can be invoked by `NtCreateCrossVmEvent()`. Therefore, to reach the vulnerable function call, we need to invoke `NtCreateCrossVmEvent()` from user space.
+
+```mermaid
+flowchart LR
+%%{init: {"flowchart": {"htmlLabels": false}} }%%
+A["NtCreateCrossVmEvent (ntdll.dll)"] 
+--> B["ExpCreateCrossVmEvent (ntoskrnl.exe)"] 
+--> C["VkiRootCalloutCreateEvent (vkrnlintvsp.sys)"] 
+--> D["VkiRootAdjustSecurityDescriptorForVmwp (vkrnlintvsp.sys)"]
+```
+
+`NtCreateCrossVmEvent()` is an undocumented function that takes an `OBJECT_ATTRIBUTES` structure as an argument. This structure includes a `SecurityDescriptor` (`SECURITY_DESCRIPTOR`), which contains the security information associated with the object — including the `Dacl`. This is where the payload should be injected in order to trigger the vulnerability.
+```c++
+NtCreateCrossVmEvent(
+    _Out_ PHANDLE CrossVmEvent,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
+    _In_ ULONG CrossVmEventFlags,
+    _In_ LPCGUID VMID,
+    _In_ LPCGUID ServiceID
+    );
+```
+
 ## Exploit
 
-Tested on: Windows 11 23H2
+Tested on: Windows 11 23H2  
 Working POC: https://github.com/ghostbyt3/WinDriver-EXP/tree/main/CVE-2025-21333/POC
 
 ![IMG1](/img/cve-2025-21333/img1.png)