# Kernel mapping and page-cache write bypass

Unbounded remap_pfn_range, paging-I/O writes without write rights, missing page-hash re-checks

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2026-05-13. Updated 2026-11-08._

## How it works
Two assumptions break. First, that a mapping is bounded by the region the caller asked for: a driver hands userspace an MMIO window via `remap_pfn_range` but sizes the mapping from the VMA length, not the register region, so a larger `mmap` reaches adjacent physical memory [E2](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-05-pixel-10-exploit-html.md). Second, that a write requires write rights: a minifilter opens a file with only attribute rights plus `IO_IGNORE_SHARE_ACCESS_CHECK`, then writes it through paging I/O (`FLTFL_IO_OPERATION_PAGING`), bypassing the `FILE_WRITE_DATA`-based check that normally blocks writes to image-mapped files [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md). A third, related break: a signature is validated at section creation, but pages re-supplied later (paging, lazy load) are only re-verified via page hashes, which are not enabled for PPL images [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-inside-microsofts-plan-to-kill-pplfault.md).

## Where it shows up
- `remap_pfn_range` calls where length comes from the VMA, not a fixed register size [E2](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-05-pixel-10-exploit-html.md)
- Minifilter or kernel code calling `FltWriteFileEx` with paging flags or `IO_IGNORE_SHARE_ACCESS_CHECK` [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md)
- `FILE_OBJECT`s opened without `FILE_WRITE_DATA` but written anyway [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md)
- Security checks at section creation (`MiValidateSectionCreate`) with no matching in-page re-check (`MiValidateInPage`) [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-inside-microsofts-plan-to-kill-pplfault.md)
- `SEC_IMAGE` sections created from files that still have user-writable references [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-inside-microsofts-plan-to-kill-pplfault.md)

## How to review
For every mapping: is the length clamped to the hardware region size, and does the caller control it? For every write path: does the `FILE_OBJECT` actually hold write access, and does the write go through the normal cached/write-checked path rather than paging I/O? For every one-time validation: find the second path that re-supplies the same bytes and confirm it re-verifies (page hashes, signature). The invariant: no kernel path may write or map memory outside the region or file rights the caller legitimately holds, and no paged-in byte may be trusted without re-verification.

## How finders spotted it
- Process Monitor at an altitude below the minifilter showed a write to an image-mapped DLL opened only for attributes; a debugger breakpoint on `FltWriteFileEx` confirmed the flags [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md)
- Noticed a new `/dev/vpu` node in a mediacodec SELinux context; a short audit of its `mmap` handler found the unbounded `remap_pfn_range` [E2](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-05-pixel-10-exploit-html.md)
- Reasoned through the loader flow: signature checked at section creation, page hashes enabled for drivers and full PPs but not PPL, so paging might bypass CI [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-inside-microsofts-plan-to-kill-pplfault.md)

## Variants seen
- Unbounded MMIO remap to physical memory [E2](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-05-pixel-10-exploit-html.md)
- Paging-I/O write bypassing image-section immutability [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md)
- Missing page-hash re-validation for PPL images [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-inside-microsofts-plan-to-kill-pplfault.md)

## Why fixes fail
E1's mitigation targeted network redirectors only, leaving the minifilter path open [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md).

## Impact and severity
All reach kernel-level code execution or memory access. E2 gives kernel code execution and root, chained behind a 0-click remote Dolby decoder bug [E2](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-05-pixel-10-exploit-html.md); E1 chains into PPL injection and remains unpatched on some fully-patched systems [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md); E3's PPLFault (admin-to-PPL) chained with GodFault (PPL-to-kernel) escalates admin to full kernel/physical memory read-write [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-inside-microsofts-plan-to-kill-pplfault.md). Impact rises when the primitive is chained with another weakness and when it crosses a trust boundary (admin to kernel, userspace to physical memory).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Chips&Media Wave677DV** (vpu_mmap) (version not stated): A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens. Report: https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-05-pixel-10-exploit-html.md
- **Microsoft Windows** (cldflt.sys) Windows 11 22631.2861: The Immutable Illusion: Pwning Your Kernel with Cloud Files. Report: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md
- **Microsoft Windows** (Code Integrity / memory manager (MiValidateSectionCreate, Mi) 25936, fixed in 25941: Inside Microsoft's plan to kill PPLFault. Report: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-inside-microsofts-plan-to-kill-pplfault.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-immutable-illusion.md
- E2: https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-05-pixel-10-exploit-html.md
- E3: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-inside-microsofts-plan-to-kill-pplfault.md