Copilot+ 的（奇遇）经历：攻击和利用 Windows NPU 驱动程序.pdf

1、#BHAS BlackHatEvents(Mis)adventures with Copilot+:Attacking and Exploiting Windows NPU DriversNicola Stauffer&Grkan Gr Nicola Stauffer Graduate Student Member of the security research team Grkan Gr Senior Lecturer Zurich Uni.of Applied Sciences(ZHAW)InIT Information Security Group(ISE)AIAI!What abou

2、t?PrivacyCostAvailabilityRun it locally!GPUNPUASICFPGACopilot+ArchitectureApplicationDX12/User Mode DriverONNX RuntimeDirectMLWDDM/MCDM Kernel DriverDevice Driver Interface(DDI)GPU/NPUWebNNhttps:/www.w3.org/2024/01/webevolve-series-events/media/slides/hu-ningxin.pdfWeb AppWebNN APIONNX Runtime WebWe

3、b NN EPDirectMLONNX RuntimeDirectMLOMG I love COM said no one everKernelmodeUsermodeDDIHear me out!What is this BH 2014?Vista called,it wants its architecture backBro gonna talk about DDI in 2025 lmaoThats some old sh*tWin32k.sysUserspaceKernelspaceGDI32.DLLDxgkrnl.sysWin32k SyscallWDDM/MCDMGPU/NPUU

4、MD_Vendor.DLLApplicationWDDMGPUhttps:/ DDI functions are required42 DDI functions are optional29 DDI functions are prohibitedhttps:/ drivers are like a box of chocolates,you never know what youre going to get.Forest GumpSet to 1Call D3DKMTEnumadapters3Iterate over handlesCheck the resulting bufferSe

5、t typeCall D3DKMTQueryAdapterInfoWe forgot a“what about”securityAttack vectorsDDI FunctionspPrivateDriverDatapPrivateDriverDataSizetwoProcess interferenceUserspaceKernelspaceWDDM/MCDMLLM 2Process 2Process 1LLM 1UserspaceKernelspaceWDDM/MCDMLLM 2ChangedProcess 2Process 1LLM 1UserspaceKernelspaceWDDM/

6、MCDMLLM 2ChangedProcess 2WTF Dude?Process 1LLM 1FirmwareOften loaded inside the NPU driverMitigationsNPUGPUUser32.dllGDI32.dllGUI stuffChrome has the mitigation enabledSo WebNN is safe,right?So WebNN is safe,right?Not yet(?)Snapping DragonsUser supplied valuesPassed to lock_virt_addr_sizeCVE-2024-53