pdfwkrnl.sys — AMD Kernel Driver Exploit (CVE-2023-20598)

Overview

This repository contains a Rust proof-of-concept exploit targeting the AMD Radeon™ Graphics Kernel Driver (pdfwkrnl.sys), specifically the vulnerability CVE-2023-20598.

The vulnerable driver exposes an IOCTL that allows an arbitrary kernel memory copy, which can be abused to achieve arbitrary read/write in kernel mode and ultimately local privilege escalation to SYSTEM.

This project was created purely for learning purposes, as part of my study of Windows kernel exploitation and vulnerable driver development.
It does not introduce new techniques and is not intended to be advanced or novel — it simply documents my learning process.

---

Vulnerability

• Driver: pdfwkrnl.sys (AMD Radeon™ Graphics Kernel Driver)
• CVE: CVE-2023-20598
• Impact: Local Privilege Escalation
• Primitive: Arbitrary kernel read/write via IOCTL

The driver fails to properly validate user-controlled pointers passed to a memory move operation, allowing controlled kernel memory access from user mode.

---

Exploitation Logic

The exploit follows a classic Windows kernel token stealing approach:

1. Open a handle to \\.\PdFwKrnl
2. Abuse the vulnerable IOCTL to gain arbitrary read/write
3. Resolve the kernel base address
4. Locate PsInitialSystemProcess
5. Traverse the _EPROCESS list to find the current process
6. Replace the current process token with the SYSTEM token
7. Spawn an elevated cmd.exe
8. Restore the original token after execution

Hardcoded _EPROCESS offsets are used and are Windows version dependent.

---

Disclaimer

This code is provided for educational purposes only.

Do not use this on systems you do not own or have permission to test.
The author takes no responsibility for misuse.

---

References

• AMD Radeon™ Graphics Kernel Driver Privilege Management Vulnerability