In this paper, the author discusses the many challenges and problems concerning user-mode callbacks in win32k. In particular, they show how win32k's dependency on global locks in providing a thread-safe environment does not integrate well with the concept of user-mode callbacks. Although many vulnerabilities related to user-mode callbacks have been addressed, their complex nature suggests that more subtle flaws might still be present in win32k. Thus, in an effort to mitigate some of the more prevalent bug classes, they conclusively provide some suggestions as to how users may protect themselves against future kernel attacks.
51d1563fd83b26e69b8116dfefd3de44db9d463eea1972b575297a33f15a2fc2
697446c515031c2d108eaf4e9936a3cda636c0150e0f6eaa6725b91a1412bbea
a2b194fb5d2e27bedaf21c0c44c5d79ba32f633a39aaa2b07d4587f4142f751c
e69c29f39e6df795ffad55b5a6e991d8a896a591565dba0e7fae3b70aacefae2
8e9026b3e0b35cd5f3acf0a3fab823cb63312b0fbac3b007fe265a4d70aa5569
95ca2d6bb2fa4b5b9573822612ebadae78c760bb9bae02e189c775b91b8a7b4c
6982b2b42b21da1e7d5ba6fa3423d838d067770aa9f2f11939cf7fe04b4450db
2c08615595d849e46ab20453d4b9b3d49b46980bda504b0f77ac01b371698a68
9554bf5a64f4aba3b5bd9752780b74606f3f6e97fcab64af840240c42e6e23b8
[MiLK] and [TeA] "Drugs, Fine Wine..."
3a7d38ef320ad2e3903f3f6a337757119e9c51f0a30a2c66305a28a0b8815801