# tcpip.sys

Published articles for tcpip.sys.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Reverse-engineering tcpip.sys: mechanics of a packet of the death (CVE-2021-24086)

DevFeed: [Reverse-engineering tcpip.sys: mechanics of a packet of the death (CVE-2021-24086)](<https://devfeed.tech/articles/reverse-engineering-tcpip-sys-mechanics-of-a-packet-of-the-death-cve-2021-24086-39712.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2021/04/15/reverse-engineering-tcpipsys-mechanics-of-a-packet-of-the-death-cve-2021-24086/>)

Author: Axel "0vercl0k" Souchet

Published: 2021-04-15T15:00:00Z

Content type: tutorial

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [TCP/IP](<https://devfeed.tech/topics/tcp-ip.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>)

Tags: [cve-2021-24086](<https://devfeed.tech/tags/cve-2021-24086.md>), [fragmentation](<https://devfeed.tech/tags/fragmentation.md>), [ipv6preassembledatagram](<https://devfeed.tech/tags/ipv6preassembledatagram.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [poc](<https://devfeed.tech/tags/poc.md>), [recursive-fragmentation](<https://devfeed.tech/tags/recursive-fragmentation.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [tcp-ip](<https://devfeed.tech/tags/tcp-ip.md>), [tcpip-sys](<https://devfeed.tech/tags/tcpip-sys.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

This article reverse-engineers CVE-2021-24086, a remotely triggerable NULL dereference in the Windows TCP/IP kernel code. It explains the patch-diffing and reverse-engineering process, the network-buffer condition behind the flaw, and the development of a proof of concept.

### Source excerpt

Introduction Since the beginning of my journey in computer security I have always been amazed and fascinated by true remote vulnerabilities. By true remotes, I mean bugs that are triggerable remotely without any user interaction. Not even a single click. As a result I am always on the lookout for ...

## First dip into the kernel pool : MS10-058

DevFeed: [First dip into the kernel pool : MS10-058](<https://devfeed.tech/articles/first-dip-into-the-kernel-pool-ms10-058-39693.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2014/03/11/first-dip-into-the-kernel-pool-ms10-058/>)

Author: Jeremy "\_\_x86" Fetiveau

Published: 2014-03-11T09:52:37Z

Content type: tutorial

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [exploit](<https://devfeed.tech/tags/exploit.md>), [exploitation](<https://devfeed.tech/tags/exploitation.md>), [integer-overflow](<https://devfeed.tech/tags/integer-overflow.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [kernel-pool](<https://devfeed.tech/tags/kernel-pool.md>), [memory-corruption](<https://devfeed.tech/tags/memory-corruption.md>), [ms10-058](<https://devfeed.tech/tags/ms10-058.md>), [poc](<https://devfeed.tech/tags/poc.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [tcpip-sys](<https://devfeed.tech/tags/tcpip-sys.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

This tutorial explores a proof-of-concept exploit for the MS10-058 vulnerability in Windows 7 kernel pool memory management. It explains how an integer overflow in tcpip.sys causes an undersized non-paged pool allocation and subsequent pool overflow, based on the author's testing in a Windows 7 32-bit virtual machine.

### Source excerpt

Introduction I am currently playing with pool-based memory corruption vulnerabilities. That's why I wanted to program a PoC exploit for the vulnerability presented by Tarjei Mandt during his first talk "Kernel Pool Exploitation on Windows 7" [3]. I think it's a good exercise to start learning about pool overflows ...