# CVE-2025-33071 — Windows KDC Proxy Service `kpssvc.dll` Request-Context Race → Use-After-Free (Unauthenticated RCE)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `kpssvc.dll` (KDC Proxy Service / KPSSVC, [MS-KKDCP]) |
| **CVE ID** | CVE-2025-33071 |
| **Impact** | Remote Code Execution (unauthenticated, network) |
| **MSRC severity** | Critical |
| **CVSS** | 8.1 / 7.1 — `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-416: Use After Free (race-triggered) |
| **Affected role** | Windows Servers configured as a **KDC Proxy (KKDCP) server** (domain controllers are *not* affected, per MSRC) |
| **Delivery** | Network — crafted KKDCP requests to the proxy; win a race (`AC:H`) |
| **KB / Fixed build** | KB5060842 — `kpssvc.dll` 10.0.26100.4343 (Windows Server 2025, build 26100; OS fixed build 10.0.26100.4349) |
| **Patch Date** | June 10, 2025 (2025-Jun) |
| **Pre-patch binary** | `kpssvc.dll` 10.0.26100.3912 — SHA256 `de28e58abf562d7e1f5946233a6bd20d30fcee22185d791840707a917c341c2b` |
| **Post-patch binary** | `kpssvc.dll` 10.0.26100.4343 — SHA256 `3471e19223648c485e1f95f148880bec59b8f4e162f6cd0f2b955b471875308c` |
| **Feature flag** | `Feature_4205429049` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation More Likely; not publicly disclosed; not exploited (per MSRC) |

> Product note: KDC Proxy (KPSSVC) is a **Server role**; MSRC lists this CVE for
> Windows Server (2012–2025), not the 24H2 client. The `kpssvc.dll` binary is the same
> 26100-based code; this diff is the Server-2025 May→June pair.

---

## Product Description

`kpssvc.dll` implements the **KDC Proxy Service (KPSSVC)** — the [MS-KKDCP] server that
proxies Kerberos AS/TGS exchanges over HTTPS. Each proxied request is tracked by a
`_KPS_IO` context object created by `KpsCreateKpsIo` and released by `KpsFreeKpsIo`.
The request is driven asynchronously through HTTP receive/send and backend-socket
connect/receive stages, each with an **I/O completion routine**
(`KpsHttp*IoCompletion`, `KpsSocket*IoCompletion`) that operates on the same
`_KPS_IO`.

---

## Vulnerability Summary

The `_KPS_IO` request context is shared across concurrent asynchronous stages
(HTTP receive, backend socket I/O, cancellation, timeout). Pre-patch, one path could
**free the `_KPS_IO` while another in-flight completion / cancellation still
referenced it** — a race (`AC:H` — "requires an attacker to win a race condition")
that yields a use-after-free of the request context (CWE-416). Because KPSSVC accepts
KKDCP requests **over the network without authentication** (`AV:N`, `PR:N`), the
freed-object reuse is a remote code-execution primitive against a server configured as
a KDC Proxy (Microsoft rates it **Critical**).

> Confirmation level: this June update is a **broad KPSSVC async-lifecycle rework**
> (15 code-changed + 21 added + 67 modified functions) under the dominant flag
> `Feature_4205429049`. The isolable mechanism is the introduction of a
> **`KpsIoLockedRef` locked-reference** wrapper that holds the `_KPS_IO` alive across
> its use; stated here at confirmed-changed level.

---

## Prerequisites and Constraints

- Network, unauthenticated (`AV:N`, `PR:N`, `UI:N`) against a **KDC Proxy server**.
- `AC:H`: win the race between a request-context teardown (cancel/timeout/completion)
  and an in-flight completion that still uses the `_KPS_IO`.
- Result: the `_KPS_IO` is freed while still referenced → use-after-free.

---

## Vulnerability Details

### Root Cause

The `_KPS_IO` request context's lifetime was not safely synchronized across the
concurrent async stages, so a teardown could free it while another completion routine
was still operating on it.

### The patch (confirmed — diff, .3912 → .4343)

The diff introduces a **`KpsIoLockedRef`** reference/lock wrapper around the `_KPS_IO`
and threads it through the request-processing paths (gated behind
`Feature_4205429049`). The clearest signal is the signature change of
`KpsProcessProxyRequest`, which now takes a **locked reference** instead of a raw
pointer, so the context is held alive (and serialized) while in use:

```c
// PRE (10.0.26100.3912):
void KpsProcessProxyRequest(_KPS_IO *ctx);                 // raw pointer to the request context

// POST (10.0.26100.4343) — PATCHED (from the diff):
void KpsProcessProxyRequest(KpsIoLockedRef &ref);          // *** locked reference holds _KPS_IO alive ***
// ... under Feature_4205429049, the async stages acquire/hold a KpsIoLockedRef on the
//     _KPS_IO; KpsFreeKpsIo (now paired with KpsCancelTimeoutTimer) releases the
//     context only once no locked reference remains, so a teardown can no longer free
//     it while an in-flight completion still references it.
```

By taking and holding a `KpsIoLockedRef` on the `_KPS_IO` across the receive / socket /
cancel / completion stages, the context can no longer be freed while another stage is
using it, closing the race use-after-free.

### Patch Completeness Assessment

**CFR-gated behind `Feature_4205429049`.** The locked-reference lifecycle runs only
when the flag is enabled; the original raw-pointer handling remains when disabled.
Verify `Feature_4205429049` is enabled to confirm the fix is live. Given unauthenticated
network RCE against KDC Proxy servers, apply KB5060842 (Server 2025) / the appropriate
June 2025 update regardless.

---

## Detection Guidance

**Behavioural.** Use-after-free / heap-corruption crashes in the KPSSVC service —
`kpssvc!KpsProcessProxyRequest`, `KpsFreeKpsIo`, and the `Kps*IoCompletion` routines —
on unpatched/flag-disabled KDC Proxy servers, correlated with bursts of KKDCP (HTTPS)
requests and cancellations/timeouts. Restrict KDC Proxy (KKDCP, TCP/443) exposure and
apply the June 2025 update on KDC-Proxy-configured servers.

**Config.** The fix is CFR-gated — confirm `Feature_4205429049` is enabled.

---

## References

- MSRC advisory — CVE-2025-33071 (Windows KDC Proxy Service (KPSSVC) Remote Code Execution), released 2025-06-10, KB5060842 (Server 2025).
- [MS-KKDCP]: Kerberos Key Distribution Center (KDC) Proxy Protocol.
- Full binary diff: `/data/patch_diffs/kpssvc_dll-cve-2025-33071-ghidriff.md`