NT OS Kernel Information Disclosure Vulnerability

https://www.crowdfense.com/nt-os-kernel-information-disclosure-vulnerability-cve-2025-53136/

71•voidsec•3h ago

Comments

Jare•2h ago

I went to check when the bug had been patched, and was left wanting. I however lack the expertise to really appreciate how much danger exists in practice, or for whom. I just know I do have Win11 24H2 and "This leak primitive is particularly useful for Windows versions 24H2 or later"

Ethee•2h ago

If you follow the CVE link included: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

It would seem this was patched in the Aug 12 security patch rollout.

Jare•33m ago

Wow thanks! I didn't even realize that was a link, it looks like just any other bold text in the page. It's weird this page would be published in Sept (if I understand correctly) and not mention the patch, but in any case that's good.

MattSteelblade•1h ago

This type of exploit is useful as part of a chain of exploits; it defeats a defense-in-depth protection.

twoodfin•1h ago

Specifically, it leaks a kernel address inside a security-sensitive structure, which is supposed to be unpredictable / unknowable because the layout of kernel memory is randomized.

If you have another exploit that will write bytes under the attacker’s control to an attacker-supplied kernel address, you will be able to do the Windows equivalent of escalate to root.

KyleBerezin•1h ago

I find myself thinking "wow, what an obvious bug. How did Microsoft not catch that?" but then I think back to some of my own extremely obvious bugs. Thankfully my code is much lower impact.

btreecat•1h ago

I still think of the lessons learned from a root traverse bug I accidentally coded into one of our internal apps as a jr dev.

You could change the URL of the image, and get any file off the system to download as long as the service account had read access.

Invaluable XP, and really glad everything was behind AD authentication and internal users were trustworthy enough and operating in a network isolated context.

globular-toast•50m ago

Yeah, having learnt very similar (if not the same) lessons myself the hard way I see great value in being able to fail badly, but with low stakes. I catch loads of bugs like these from jrs before they hit prod but I don't feel like they're learning the fundamentals of security like trust, sanitising inputs, least privilege etc.

lawlessone•12m ago

sounds like how wordpress used to be. could explore all the folders and get any file of site with something like website.com/content/2010/

lysace•1h ago

Random: Perhaps that full source code leak in 2004 actually helped harden the kernel, long term?

https://betanews.com/2004/02/13/windows-source-leak-traces-b...

p_ing•41m ago

KASLR was not present in Windows 2000, which is what this vulnerability breaks through.

lysace•29m ago

That’s one vulnerability.

mkolassa•24m ago

It’s interesting that the KB that patches this on Windows 11 (KB5063878) is the same one that was tied up in all the Phison SSD drama.

Native ACME support comes to Nginx

Top model scores may be skewed by Git history leaks in SWE-bench

Bulletproof host Stark Industries evades EU sanctions

NT OS Kernel Information Disclosure Vulnerability

Claude's Memory Architecture Is the Polar Opposite of ChatGPT's

Launch HN: Ghostship (YC S25) – AI agents that find bugs in your web app

Behind the scenes of Bun Install

'Robber bees' invade apiarist's shop in attempted honey heist

Adam (YC W25) Is Hiring to Build the Future of CAD

GrapheneOS and Forensic Extraction of Data (2024)

A tech-law measurement and analysis of event listeners for wiretapping

The Helix Text Editor

CRISPR offers new hope for treating diabetes

Conway's Game of Life, but musical

Making io_uring pervasive in QEMU [pdf]

AirPods live translation blocked for EU users with EU Apple accounts

Public Suffix List

Show HN: Making a cross-platform game in Go using WebRTC Datachannels

Spiral

An engineering history of the Manhattan Project

From burner phones to decks of cards: NYC teens adjusting to the smartphone ban

Reshaped is now open source

Tumult and Sympathy – The Letters of Oliver Sacks

Center for the Alignment of AI Alignment Centers

Pulling an Inverse Conway Maneuver at Netflix (2023)

Samsung taking market share from Apple in U.S. as foldable phones gain momentum

Beyond package management: How Nix refactored my digital life

Gregg Kellogg has died

Removing yellow stains from fabric with blue light

GrapheneOS accessed Android security patches but not allowed to publish sources

NT OS Kernel Information Disclosure Vulnerability

Comments

Native ACME support comes to Nginx

Top model scores may be skewed by Git history leaks in SWE-bench

Bulletproof host Stark Industries evades EU sanctions

NT OS Kernel Information Disclosure Vulnerability

Claude's Memory Architecture Is the Polar Opposite of ChatGPT's

Launch HN: Ghostship (YC S25) – AI agents that find bugs in your web app

Behind the scenes of Bun Install

'Robber bees' invade apiarist's shop in attempted honey heist

Adam (YC W25) Is Hiring to Build the Future of CAD

GrapheneOS and Forensic Extraction of Data (2024)

A tech-law measurement and analysis of event listeners for wiretapping

The Helix Text Editor

CRISPR offers new hope for treating diabetes

Conway's Game of Life, but musical

Making io_uring pervasive in QEMU [pdf]

AirPods live translation blocked for EU users with EU Apple accounts

Public Suffix List

Show HN: Making a cross-platform game in Go using WebRTC Datachannels

Spiral

An engineering history of the Manhattan Project

From burner phones to decks of cards: NYC teens adjusting to the smartphone ban

Reshaped is now open source

Tumult and Sympathy – The Letters of Oliver Sacks

Center for the Alignment of AI Alignment Centers

Pulling an Inverse Conway Maneuver at Netflix (2023)

Samsung taking market share from Apple in U.S. as foldable phones gain momentum

Beyond package management: How Nix refactored my digital life

Gregg Kellogg has died

Removing yellow stains from fabric with blue light

GrapheneOS accessed Android security patches but not allowed to publish sources