Skip to content

PreviousMode Manipulation

Overwriting KTHREAD.PreviousMode to bypass user/kernel boundary checks.

Description

ExGetPreviousMode() returns the PreviousMode field from the current KTHREAD structure, which indicates whether a system call originated from user mode or kernel mode. If an attacker can overwrite this field to KernelMode (0), all subsequent ProbeForRead/ProbeForWrite calls become no-ops, and the thread gains kernel-level access to system calls.

CVE Driver Description
CVE-2024-26229 csc.sys Missing access check allows EoP

AutoPiff Detection

  • previous_mode_gating_added
  • access_mode_enforcement_added