# Introducing a New Vulnerability Class: False File Immutability

Windows Code Integrity maps security catalogs over network redirectors without write sharing, letting an attacker swap a signed catalog for a malicious one mid-parse to load an unsigned kernel driver.

- Payout: Research
- Severity: high
- Program: Windows
- Credited: Gabriel Landau
- Disclosed: 2024-07-11
- Write-up quality: 9/10
- Original: https://www.elastic.co/security-labs/threat-command/false-file-immutability
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-false-file-immutability
- Tags: domain:desktop impact:privesc impact:rce kind:research platform:threat-intel sev:high tech:windows technique:race-window technique:source-review vuln:privilege-escalation vuln:race-condition vuln:signature-replay

**Target:** Windows Code Integrity (ci.dll) security catalog processing over network redirectors
**Root cause:** CI opens security catalogs without FILE_SHARE_WRITE and maps them as data sections, assuming immutability; a network redirector server can modify the backing file after signature verification but before parsing, and data sections have no page hashes.
**Steps:**
1. Plant a malicious security catalog on attacker-controlled storage (SMB/network redirector) containing the authentihash of an unsigned driver.
2. Install a symlink to that catalog in C:\Windows\System32\CatRoot so CI discovers it.
3. Request loading of the unsigned driver; CI re-scans CatRoot, maps the catalog, and validates its signature (server returns a genuine Microsoft-signed catalog).
4. Empty the system working set to evict the verified catalog pages from kernel memory.
5. Toggle the catalog between benign and malicious versions while CI parses it, so the malicious authentihash page is faulted in after verification.
6. CI finds the malicious driver's authentihash and loads the driver, yielding kernel code execution.
**How found:** Noticed CI maps catalogs with ZwCreateSection(SEC_COMMIT) as data sections (no page hashes) and opens without FILE_SHARE_WRITE; combined with the earlier PPLFault insight that network redirectors need not honor Windows sharing semantics, hypothesized a PPLFault-style attack on catalog processing.
**Exploitation:** Attacker controls the SMB/network server backing the catalog. A race is widened by using a 4MB catalog with the target hash near the end, CPU-priority threads to starve CI, one thread flushing the working set and one repeatedly loading the driver. Success requires CI to verify the benign catalog then parse the malicious one; failure modes are hash read during verification or an even number of toggles.
**Escalation:** Admin-to-kernel via unsigned driver load; defeats UMCI and PPL protections (AV/EDR process protection), enabling instant-kill of security software. Related PPLFault chain (GodFault) reaches full physical memory read/write.
**Insight:** When auditing kernel/user code that maps or reads attacker-reachable files for integrity checks, check whether it relies on share-mode denial for immutability and whether it re-reads the mapping after verification; network redirectors and data sections (no page hashes) break that assumption, so look for double-read windows between signature validation and parsing.