b2ahex @b2ahex - Twitter Profile

about 1 month ago

Really honored to be part of BlueHat Asia. Met so many brilliant researchers and cool people here. Huge thanks to MSRC for the invitation and for organizing such an amazing event. Had a great time!🙌

b2ahex's tweet photo. Really honored to be part of BlueHat Asia. Met so many brilliant researchers and cool people here. Huge thanks to MSRC for the invitation and for organizing such an amazing event. Had a great time!🙌 https://t.co/VDk6pTpV0T

Microsoft BlueHat

@MSFTBlueHat

about 1 month ago

Sometimes the most interesting vulnerabilities are not caused by a single bug, but by assumptions that quietly break over time. At BlueHat Asia, Microsoft MVRs Zhu Qing and b2ahex (@b2ahex) shared their research into the Windows DirectX kernel, uncovering dozens of vulnerabilities spanning local privilege escalation, guest-to-host attack paths in Hyper-V, information disclosure, and denial-of-service scenarios. Their work resulted in 32 reported vulnerabilities and 26 confirmed CVEs at the time of submission. From user-mode interactions with dxgkrnl to host-side processing in GPU-PV environments, the researchers demonstrated how subtle violations of security assumptions can create powerful exploitation opportunities. Beyond the vulnerability findings themselves, the talk offered a practical framework for security research: trace every path from attacker-controlled input to the final privileged action, and verify that security guarantees still hold at each step. It was a compelling look at how deep technical analysis can uncover entire classes of vulnerabilities across complex systems.

MSFTBlueHat's tweet photo. Sometimes the most interesting vulnerabilities are not caused by a single bug, but by assumptions that quietly break over time.

At BlueHat Asia, Microsoft MVRs Zhu Qing and b2ahex (@b2ahex) shared their research into the Windows DirectX kernel, uncovering dozens of vulnerabilities spanning local privilege escalation, guest-to-host attack paths in Hyper-V, information disclosure, and denial-of-service scenarios. Their work resulted in 32 reported vulnerabilities and 26 confirmed CVEs at the time of submission.

From user-mode interactions with dxgkrnl to host-side processing in GPU-PV environments, the researchers demonstrated how subtle violations of security assumptions can create powerful exploitation opportunities.

Beyond the vulnerability findings themselves, the talk offered a practical framework for security research: trace every path from attacker-controlled input to the final privileged action, and verify that security guarantees still hold at each step. It was a compelling look at how deep technical analysis can uncover entire classes of vulnerabilities across complex systems.

0

27

2

7

4K

0

13

1

2

863

b2ahex retweeted

Microsoft BlueHat

@MSFTBlueHat

about 2 months ago

We're excited to announce our next BlueHat Asia speakers: b2ahex (@b2ahex), Senior Security Researcher, four-time MSRC Most Valuable Researcher (MVR), and Pwnie Award winner; and Zhu Qing, CTO of Snowrock, Senior Security Engineer, MVR, and top MSRC Windows Bounty recipient. In their talk, "Broken Contracts in the DirectX Kernel: Local Elevation of Privilege and Hyper-V Guest-to-Host Remote Code Execution," b2ahex and Zhu Qing present a systematic study of object lifetime bugs in the Windows DirectX kernel, a component that today spans the boundaries between user mode, kernel mode, graphics drivers, and virtualized environments. During their research, the pair uncovered recurring vulnerability patterns involving handle resurrection, object type confusion, object lifetime management failures, and guest-controlled handles crossing trust boundaries. These issues affected both traditional Windows graphics paths and Hyper-V GPU paravirtualization scenarios, demonstrating how security flaws in graphics subsystems can evolve into virtualization isolation risks. Their work led to the reporting of 32 vulnerabilities in Dxgkrnl components, spanning Windows Hyper-V remote code execution, elevation of privilege, kernel information disclosure, and denial of service vulnerabilities. At the time of submission, 26 of these reports had been confirmed and assigned CVEs. Through real-world case studies, the session examines both local privilege escalation and Hyper-V guest-to-host vulnerabilities, explores the root causes behind these bug classes, and discusses practical approaches for strengthening object lifetime management, handle validation, locking mechanisms, and virtualization boundary protections. This is a rare opportunity to hear directly from researchers who have spent years uncovering some of the most impactful vulnerability classes within the Windows graphics stack.

MSFTBlueHat's tweet photo. We're excited to announce our next BlueHat Asia speakers: b2ahex (@b2ahex), Senior Security Researcher, four-time MSRC Most Valuable Researcher (MVR), and Pwnie Award winner; and Zhu Qing, CTO of Snowrock, Senior Security Engineer, MVR, and top MSRC Windows Bounty recipient.

In their talk, "Broken Contracts in the DirectX Kernel: Local Elevation of Privilege and Hyper-V Guest-to-Host Remote Code Execution," b2ahex and Zhu Qing present a systematic study of object lifetime bugs in the Windows DirectX kernel, a component that today spans the boundaries between user mode, kernel mode, graphics drivers, and virtualized environments.

During their research, the pair uncovered recurring vulnerability patterns involving handle resurrection, object type confusion, object lifetime management failures, and guest-controlled handles crossing trust boundaries. These issues affected both traditional Windows graphics paths and Hyper-V GPU paravirtualization scenarios, demonstrating how security flaws in graphics subsystems can evolve into virtualization isolation risks.

Their work led to the reporting of 32 vulnerabilities in Dxgkrnl components, spanning Windows Hyper-V remote code execution, elevation of privilege, kernel information disclosure, and denial of service vulnerabilities. At the time of submission, 26 of these reports had been confirmed and assigned CVEs.

Through real-world case studies, the session examines both local privilege escalation and Hyper-V guest-to-host vulnerabilities, explores the root causes behind these bug classes, and discusses practical approaches for strengthening object lifetime management, handle validation, locking mechanisms, and virtualization boundary protections. This is a rare opportunity to hear directly from researchers who have spent years uncovering some of the most impactful vulnerability classes within the Windows graphics stack.

0

20

3

3K

b2ahex

@b2ahex

Who to follow

Last Seen Users on Sotwe

Trends for you

Most Popular Users