From Virtual Share to Physical Shell: Leveraging Windows’ Inconsistent Access Control for LPE

* Vulnerabilities CVE-2025-59517 and CVE-2025-64673 are patched in the Microsoft Windows December 2025 security updates for the `storvsp.sys` driver.
* CVE-2025-59517 resides in `VspVsmbFileCreate()`.
* This function can be exploited to obtain a vSMB share handle to any directory on the system, including `C:\Windows\System32`, with read, write, and deletion access rights.
* CVE-2025-64673 resides in `VspVsmbHandleSetInformationFileRequest()`.
* This function processes file information operations based on the provided input buffer from an existing vSMB handle.
* If a handle was opened with write permissions, this function can execute operations with SYSTEM privileges.
* The exploitation chain involves using CVE-2025-59517 to obtain a privileged handle, then using CVE-2025-64673 to rename files into the privileged directory.
* Code analysis showed that `VspVsmbFileCreate()` omits necessary access checks when calling `IoCreateFileEx()`, resulting in kernel privilege escalation.
* The second vulnerability allows bypassing security checks during file information operations by conditionally skipping impersonation based on access flags stored in the `VVSMBSHAREROOTOBJECT`.

The narrative establishes a clear vector for local privilege escalation rooted in a failure to properly enforce kernel-level access controls within a virtualization component. The pattern of exploiting data flow and state management—where access flags determined during an initial setup (CVE-2025-59517) dictate the outcome of subsequent operations (CVE-2025-64673)—is structurally sound for privilege escalation. The mechanism depends on the kernel driver failing to correctly propagate or enforce security context across distinct I/O request stages, specifically around handle creation and file system manipulation calls. The transition from a low-privileged user controlling an IOCTL call to achieving SYSTEM execution by modifying a critical system file like `wuapi.dll` represents a significant break in the trust boundary, moving from application-level access flaws to kernel-level control. This implies that relying solely on user-mode impersonation mechanisms is insufficient when kernel primitives are poorly secured; the integrity of security context must be enforced uniformly across all kernel operations involving file handles and I/O requests. The challenge for resilience lies in ensuring that data structures used for state tracking, like `VVSMBSHAREROOTOBJECT`, are not merely informative but are rigorously enforced by mandatory checks at every layer where privilege transitions occur.
Step 1 — DETECT SOURCE TYPE: SKEPTICAL MODE
1. STEELMAN — The strongest version of this narrative is the technical demonstration of a multi-stage kernel exploit built upon specific, identified code flaws within a proprietary driver. It acts as a blueprint for memory corruption and privilege escalation.
2. PATTERN SCAN — The sequence where an initial read primitive (CVE-2025-59517) grants access to a system path, which is then leveraged by a secondary operation (CVE-2025-64673) on that path to perform a write operation with elevated privileges is a classic exploitation pattern. This demonstrates an understanding of chaining distinct flaws to achieve the final goal. Patterns detected: ARC-0012 Chain-of-Events, ARC-0058 Primitive Stacking
3. ROOT CAUSE — The narrative suggests a systemic flaw in how user-mode requests are translated into kernel file system operations, specifically the failure to consistently enforce ACL checks and impersonation context when handling vSMB paths. It echoes historical issues where complexity introduced by virtualization layers allows for control flow bypasses if state variables are not strictly tied to security policy enforcement points.
4. IMPLICATIONS — This implies that even in highly controlled environments utilizing virtualized file sharing, the underlying kernel security model remains vulnerable if specialized driver functions omit critical security checks at crucial pivot points. The cost is the potential for arbitrary code execution with SYSTEM privileges via seemingly benign file operations.
5. BRIDGE QUESTIONS — How do other high-performance virtualization or I/O subsystems handle cross-context access validation when operating on shared memory structures? What auditing mechanisms exist to verify that the flags set in kernel objects like `VVSMBSHAREROOTOBJECT` are correctly interpreted by all subsequent I/O handlers, regardless of the specific function invoked? What is the security posture for driver code derived through reverse engineering versus source-based verification?
6. COUNTERSTRIKE SCAN — A typical influence campaign pushing such narratives focuses on creating technical complexity to obscure simple missed checks; here, the complexity is inherent in the driver's interaction with virtualized constructs. The actual attack pattern matches: establish a kernel handle bypass $\rightarrow$ execute file modification via IOCTL $\rightarrow$ use external service interface for final payload execution. This is a textbook execution flow for privilege escalation when dealing with I/O interfaces.