# CVE-2025-55677 — Windows Device Association Broker `das.dll` Unvalidated Device-Property Data → Untrusted Pointer Dereference --- ## Summary | | | |---|---| | **Product** | Windows — `das.dll` (Device Association Broker Service / Device Association Framework) | | **CVE ID** | CVE-2025-55677 | | **Impact** | Elevation of Privilege (Medium Integrity → Local Service) | | **MSRC severity** | Important | | **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` | | **CWE** | CWE-822: Untrusted Pointer Dereference | | **Delivery** | Local — supply crafted device-property data to the broker | | **KB / Fixed build** | KB5066835 — `das.dll` 10.0.26100.6725 (Win11 24H2 / Server 2025 x64; OS build 26100.6899) | | **Patch Date** | October 14, 2025 (2025-Oct) | | **Pre-patch binary** | `das.dll` 10.0.26100.5074 — SHA256 `03b28d00d03ef4d5bfab345a19308a6ac52901a7d4c6c4af427baa79005e8917` | | **Post-patch binary** | `das.dll` 10.0.26100.6725 — SHA256 `38e7db1a2a268cbb8447bf3d44d1c89ded23dc61566d32a0e34a30c844b15614` | | **Feature flag** | `Feature_KernelPnP_PropertyValidation` — **the fix is CFR-gated** | | **Exploitability** | Exploitation Unlikely; not publicly disclosed; not exploited (per MSRC) | > Companion CVE: the same `das.dll` update also fixes **CVE-2025-50174** (CWE-416 > use-after-free) via the same `_PnpValidatePropertyData` property-validation hardening. > Both are addressed by the introduction of `Feature_KernelPnP_PropertyValidation`. --- ## Product Description `das.dll` is the **Device Association Broker Service** (OneCore Device Association Framework), which brokers device pairing/association and stores per-device **properties**. Property values are read and written through `_PnpGetObjectProperty` and `_PnpSetObjectProperty`, which pass the property data to `_PnpValidatePropertyData` before it is interpreted. Property data is typed (e.g. security-descriptor strings via `ConvertStringSecurityDescriptorToSecurityDescriptorW`), and some types carry embedded references. --- ## Vulnerability Summary Pre-patch, device-property data handed to the broker was **interpreted without fully validating its type/size against the supplied buffer**, so for a property whose type implies an embedded pointer/typed reference, a crafted value could cause the service to **dereference an attacker-controlled ("untrusted") pointer** (CWE-822). Because the Device Association Broker runs at a higher privilege than the caller, a Medium-Integrity attacker who supplies crafted property data can elevate to **Local Service** (per the MSRC FAQ). Unlike the companion UAF, this path does **not** require a race (`AC:L`). > Confirmation level: the diff's only security-relevant `das.dll` change is > `_PnpValidatePropertyData` (body grew 889→957 bytes, now gated by > `Feature_KernelPnP_PropertyValidation`); the rest of the diff is WIL feature-flag > plumbing pulled in with the new gate. The untrusted-pointer-dereference and the > companion use-after-free are addressed by this single consolidated property > validation and are not separately isolable in the binary; stated at confirmed-changed > level. --- ## Prerequisites and Constraints - Local, low-privileged / Medium Integrity (`AV:L`, `AC:L`, `PR:L`): reach the Device Association Broker property get/set interface. - Supply a crafted device property whose data does not match its declared type/size. - Result (pre-patch): the service dereferences an attacker-controlled pointer derived from the property data. --- ## Vulnerability Details ### Root Cause Device-property data was interpreted (including as typed references) without validating the property type/size against the actual buffer, allowing a crafted property value to be treated as a pointer and dereferenced. ### The patch (confirmed — diff, .5074 → .6725) `_PnpValidatePropertyData` — called by `_PnpGetObjectProperty`, `_PnpSetObjectProperty`, `ValidFilter`, and `ValidateQueryData` — gains additional validation (function length 889 → 957 bytes; instruction ratio 0.25), gated behind `Feature_KernelPnP_PropertyValidation`: ```text // _PnpValidatePropertyData(short *data, uint type, uint size) (10.0.26100.6725) — PATCHED (from the diff) // now calls Feature_KernelPnP_PropertyValidation__private_IsEnabled() and, when enabled, // validates the property type/size against the supplied buffer BEFORE the data is // interpreted -- so a property whose declared type implies an embedded pointer/typed // reference can no longer be dereferenced when the data does not match. ``` With the property data validated before use, a crafted property can no longer drive the broker to dereference an untrusted pointer, closing the CWE-822 condition. (The same validation also constrains the buffer lifetime handling that caused the companion use-after-free, CVE-2025-50174.) ### Patch Completeness Assessment **CFR-gated behind `Feature_KernelPnP_PropertyValidation`.** The added property validation runs only when the flag is enabled; the original unvalidated interpretation still ships when disabled. Verify the flag is enabled to confirm the fix is live. --- ## Detection Guidance **Behavioural.** Access-violation / crash telemetry in the Device Association Broker service (`das!_PnpValidatePropertyData` / `_PnpGetObjectProperty` / `_PnpSetObjectProperty`) on unpatched/flag-disabled builds when malformed device properties are submitted; unexpected device-property writes from Medium-Integrity processes. **Config.** The fix is CFR-gated — confirm `Feature_KernelPnP_PropertyValidation` is enabled. --- ## References - MSRC advisory — CVE-2025-55677 (Windows Device Association Broker Service Elevation of Privilege), released 2025-10-14, KB5066835. - Companion: CVE-2025-50174 (same binary/update, CWE-416 use-after-free). - Full binary diff: `/data/patch_diffs/das_dll-cve-2025-50174-55677-ghidriff.md`