> But even better, it has a security descriptor allowing Everyone + Low IL R/W Access, and an IOCTL interface with absolutely no Probes/SEH, which yes, dereferences wild pointers. They don't even bother checking for input size or output sizes.
If that's true of the driver, then it's a sec vuln regardless of what the MSR bit does or doesn't do, no?
> But even better, it has a security descriptor allowing Everyone + Low IL R/W Access, and an IOCTL interface with absolutely no Probes/SEH, which yes, dereferences wild pointers. They don't even bother checking for input size or output sizes.
If that's true of the driver, then it's a sec vuln regardless of what the MSR bit does or doesn't do, no?