Recreate-cve-2023-21768

产生原因：对比202209和202307版的AFD.sys，在函数AfdNotifyRemoveIOCompletion中，202209版的Windows和202307版的Windows都有一处使用ProbeForWrite函数检测一段内存区域是否在用户态，但检测的buffer地址有0x8字节的不同。而在该漏洞patch之前，没有该检查，可以猜测202209版的buffer的检查地址可能不太正确而可能无效。而该检查的buffer与中间一步赋值有关：DWORD a3 + 24 = v20;，其中应该检查的buffer是a3+24，而v20的值与v8 =...

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The...