k0shl of Cyber Kunlun published the root cause and exploitation walkthrough for CVE-2022-22715, the “Windows Dirty Pipe” bug in npfs.sys he used at TianfuCup 2021 to escape the Adobe Reader sandbox.
When an AppContainer or restricted process creates a LOCAL\ pipe, the translated name length is computed in a ushort, so a long name wraps the allocation size to zero and a leading backslash underflows the buffer length to 0xfffe: a 64 KB paged-pool overflow.
Taming that takes adjacent LFH and VS subsegments, WNF state data and _TOKEN objects for arbitrary read/write, plus a lot of cleanup.
Microsoft patched it in February 2022 as an “Important” elevation of privilege rated “Exploitation More Likely”, after almost a decade of nobody checking the arithmetic.
