# CVE-2025-50174 — Windows Device Association Broker `das.dll` Device-Property Handling Race → Use-After-Free

---

## Summary

| | |
|---|---|
| **Product** | Windows — `das.dll` (Device Association Broker Service / Device Association Framework) |
| **CVE ID** | CVE-2025-50174 |
| **Impact** | Elevation of Privilege (Medium Integrity → Local Service) |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-416: Use After Free (race-triggered) |
| **Delivery** | Local — win a race on device-property get/set |
| **KB / Fixed build** | KB5066835 — `das.dll` 10.0.26100.6725 (Win11 24H2 / Server 2025 x64; OS build 26100.6899) |
| **Patch Date** | October 14, 2025 (2025-Oct) |
| **Pre-patch binary** | `das.dll` 10.0.26100.5074 — SHA256 `03b28d00d03ef4d5bfab345a19308a6ac52901a7d4c6c4af427baa79005e8917` |
| **Post-patch binary** | `das.dll` 10.0.26100.6725 — SHA256 `38e7db1a2a268cbb8447bf3d44d1c89ded23dc61566d32a0e34a30c844b15614` |
| **Feature flag** | `Feature_KernelPnP_PropertyValidation` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

> Companion CVE: the same `das.dll` update also fixes **CVE-2025-55677** (CWE-822
> untrusted pointer dereference) via the same `_PnpValidatePropertyData` property
> validation. Both are addressed by the introduction of
> `Feature_KernelPnP_PropertyValidation`.

---

## Product Description

`das.dll` is the **Device Association Broker Service** (OneCore Device Association
Framework), brokering device pairing/association and per-device **properties**.
Property values are read/written via `_PnpGetObjectProperty` / `_PnpSetObjectProperty`,
which route property data through `_PnpValidatePropertyData`. Typed property values —
e.g. security-descriptor strings converted with
`ConvertStringSecurityDescriptorToSecurityDescriptorW` and released with `LocalFree` —
involve allocated buffers whose lifetime must be managed across concurrent operations.

---

## Vulnerability Summary

Pre-patch, the broker's device-property get/set handling did not adequately serialize /
validate the lifetime of a property-data buffer/object against concurrent operations,
so a **race** (`AC:H` — "requires an attacker to win a race condition") between
property access and teardown could **free a buffer/object while it was still in use** —
a use-after-free (CWE-416). Because the Device Association Broker runs at higher
privilege than the caller, a Medium-Integrity attacker who wins the race can elevate to
**Local Service** (per the MSRC FAQ).

> Confirmation level: the diff's only security-relevant `das.dll` change is
> `_PnpValidatePropertyData` (body grew 889→957 bytes, now gated by
> `Feature_KernelPnP_PropertyValidation`); the remaining diff is WIL feature-flag
> plumbing pulled in with the new gate. The use-after-free and the companion
> untrusted-pointer-dereference (CVE-2025-55677) are addressed by this single
> consolidated property validation and are not separately isolable in the binary;
> stated at confirmed-changed level.

---

## Prerequisites and Constraints

- Local, low-privileged / Medium Integrity (`AV:L`, `PR:L`); `AC:H` — must win a race
  between a device-property operation and the release/teardown of its data buffer.
- Result: a property-data buffer/object is freed while still referenced by the broker.

---

## Vulnerability Details

### Root Cause

The device-property get/set path did not safely validate/serialize a property-data
buffer's lifetime against concurrent operations, so a teardown could free it while
another operation still used it.

### The patch (confirmed — diff, .5074 → .6725)

The device-property validation routine `_PnpValidatePropertyData` — called by
`_PnpGetObjectProperty`, `_PnpSetObjectProperty`, `ValidFilter`, and `ValidateQueryData`
— is hardened (function length 889 → 957 bytes; instruction ratio 0.25) and gated
behind `Feature_KernelPnP_PropertyValidation`:

```text
// _PnpValidatePropertyData(short *data, uint type, uint size) (10.0.26100.6725) — PATCHED (from the diff)
//   under Feature_KernelPnP_PropertyValidation, property data is validated for
//   type/size/buffer consistency before use, constraining how the property-data
//   buffer/object (e.g. the converted security descriptor freed via LocalFree) is
//   handled -- so it can no longer be used after being freed on a racing path.
```

By validating property data before it is used (and constraining the associated buffer
handling), the broker no longer operates on a freed property-data object on a racing
path, closing the use-after-free. (The same validation also closes the companion
untrusted-pointer-dereference, CVE-2025-55677.)

### Patch Completeness Assessment

**CFR-gated behind `Feature_KernelPnP_PropertyValidation`.** The added validation runs
only when the flag is enabled; the original handling still ships when disabled. Verify
the flag is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Use-after-free / heap-corruption crashes in the Device Association
Broker service (`das!_PnpValidatePropertyData` / `_PnpGetObjectProperty` /
`_PnpSetObjectProperty`) on unpatched/flag-disabled builds, correlated with concurrent
device-property operations from Medium-Integrity processes.

**Config.** The fix is CFR-gated — confirm `Feature_KernelPnP_PropertyValidation` is
enabled.

---

## References

- MSRC advisory — CVE-2025-50174 (Windows Device Association Broker Service Elevation of Privilege), released 2025-10-14, KB5066835.
- Companion: CVE-2025-55677 (same binary/update, CWE-822 untrusted pointer dereference).
- Full binary diff: `/data/patch_diffs/das_dll-cve-2025-50174-55677-ghidriff.md`