# CVE-2025-32722 — Windows Storage Port Driver `storport.sys` Storage-Diagnostic IOCTL Missing Admin Check → Kernel-Address Disclosure

---

## Summary

| | |
|---|---|
| **Product** | Windows — `storport.sys` (Storage Port Driver) |
| **CVE ID** | CVE-2025-32722 |
| **Impact** | Information Disclosure (local — kernel memory addresses) |
| **MSRC severity** | Important |
| **CVSS** | 5.5 / 4.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C` |
| **CWE** | CWE-284: Improper Access Control |
| **Delivery** | Local — a low-privileged (authorized) user issues the storage-diagnostic IOCTL |
| **KB / Fixed build** | KB5060999 — `storport.sys` 10.0.22621.5547 (Win11 22H2/23H2 x64) |
| **Patch Date** | June 10, 2025 (2025-Jun) |
| **Pre-patch binary** | `storport.sys` 10.0.22621.5415 — SHA256 `b4911f58cfd621f5937fcc43cd42f7808c6bc46864d4eb437fe22d3f95d9f693` |
| **Post-patch binary** | `storport.sys` 10.0.22621.5547 — SHA256 `75e893b3a1ef309ffde2b2866412b7d760ff66dcfa11bec602d3bce4d6d517a5` |
| **Feature flag** | `Feature_1890851130` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely / Unproven (E:U); not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`storport.sys` is the Windows **Storage Port Driver**, the kernel port driver that sits between class
drivers and storage miniport (HBA/adapter) drivers. Among its device-control surface is a
**storage-diagnostic IOCTL**, handled by `RaUnitStorageDiagnosticIoctl`, which assembles a diagnostic
buffer for a storage unit/miniport via `RaBuildDiagnosticBufferForMiniport`. That diagnostic data
includes **kernel-space memory addresses**.

---

## Vulnerability Summary

Pre-patch, `RaUnitStorageDiagnosticIoctl` produced and returned the diagnostic buffer to **any
authorized caller** — no check that the caller was an administrator. Because the buffer embeds
kernel-space memory addresses, a low-privileged local user could invoke the IOCTL and read back
**kernel addresses**, defeating KASLR and providing a building block for further kernel exploitation.
This is an improper-access-control information disclosure (CWE-284); the MSRC FAQ describes it as
"disclosure of certain memory address within kernel space." Microsoft rates it **Important, 5.5**
(`C:H/I:N/A:N`).

---

## Prerequisites and Constraints

- Local, low-privileged but authorized access (`AV:L`, `AC:L`, `PR:L`, `UI:N`) able to open the
  storport device and issue the diagnostic IOCTL.
- No memory corruption is involved — the flaw is a missing privilege check on an
  information-returning path; the impact is confidentiality only (`C:H/I:N/A:N`).

---

## Vulnerability Details

### Root Cause

The storage-diagnostic IOCTL handler returned kernel-address-bearing diagnostic data without verifying
the caller's privilege level, so any authorized user could obtain kernel memory addresses.

### The patch (confirmed — diff, .5415 → .5547)

Gated behind `Feature_1890851130`, `RaUnitStorageDiagnosticIoctl` now calls a **new**
`RaidCallerIsAdmin()` and only builds/returns the diagnostic buffer for administrators:

```c
// RaUnitStorageDiagnosticIoctl (10.0.22621.5547) — PATCHED (from the diff)
uVar8 = Feature_1890851130__private_IsEnabledDeviceUsage();
if (/* feature enabled && */ (cVar5 = RaidCallerIsAdmin(), cVar5 != '\0') /* && ... */) {
    piVar9  = RaBuildDiagnosticBufferForMiniport(...);      // kernel-address-bearing buffer
    uVar10  = RaidDiagnosticIoctlStatusToNtStatus(iVar1);
    // ... return the diagnostic data ...
}
return;                                                     // non-admin: no diagnostic buffer

// RaidCallerIsAdmin (NEW) — from the diff
SeCaptureSubjectContext(local_28);
SeLockSubjectContext(local_28);
uVar1 = SeTokenIsAdmin(/* caller token */);
SeUnlockSubjectContext(local_28);
SeReleaseSubjectContext(local_28);
return uVar1;
```

`RaidCallerIsAdmin` captures and locks the caller's **subject security context**, calls
`SeTokenIsAdmin`, then releases the context — a standard, race-safe administrator check. With the gate
in place, the kernel-address-bearing diagnostic buffer is returned only to administrators, closing the
disclosure to unprivileged callers.

### Patch Completeness Assessment

**CFR-gated behind `Feature_1890851130`.** The admin check runs only when the flag is enabled; the
original unchecked path still ships when it is disabled. Verify the flag is enabled to confirm the fix
is live. The fix is a clean access-control addition (no data-shape change), so no residual leak remains
on the gated path.

---

## Detection Guidance

**Behavioural.** Non-administrative processes opening the storport device and issuing the
storage-diagnostic IOCTL; on unpatched/flag-disabled builds this succeeds and returns kernel addresses.
There is no crash signature — this is an infoleak, so hunt on the access pattern rather than on faults.

**Config.** The fix is CFR-gated — confirm `Feature_1890851130` is enabled, and that the June 2025 (or
later) cumulative update is installed (for 22H2/23H2, `storport.sys` 10.0.22621.5547 / KB5060999).

---

## References

- MSRC advisory — CVE-2025-32722 (Windows Storage Port Driver Information Disclosure), released 2025-06-10, KB5060999 (and per-SKU KBs).
- Full binary diff: `/data/patch_diffs/storport_sys-cve-2025-32722-ghidriff.md`