# CVE-2025-59514 — Microsoft Streaming Service Proxy `mskssrv.sys` Registry-Symlink EoP via Missing `OBJ_FORCE_ACCESS_CHECK` in `UpdateMediumCache`

---

## Summary

| | |
|---|---|
| **Product** | Microsoft Windows — `mskssrv.sys` (Microsoft Kernel Streaming / KS Service, "Streaming Service Proxy") |
| **CVE ID** | CVE-2025-59514 |
| **Impact** | Elevation of Privilege |
| **MSRC severity** | Important |
| **CWE** | CWE-269: Improper Privilege Management (MSRC) / CWE-285: Improper Authorization |
| **CVSS** | 7.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| **Patch Date** | November 11, 2025 |
| **Pre-patch binary** | `mskssrv.sys` 10.0.26100.7019 (Oct 2025) — SHA256 `7763ca15ee9b4480f4abff6dc44d17932b8b0dc59757d1bb434614e6355b8d1f` |
| **Post-patch binary** | `mskssrv.sys` 10.0.26100.7171 (Nov 11 2025 fix) — SHA256 `85b6bc83bd4090877b886bd64fe6dbc1fc2a8fc6c71c299439dfc4f079b8b2a8` |
| **Feature flag** | `Feature_3602159931` — **the fix is CFR-gated** |

---

## Product Description

`mskssrv.sys` is the Microsoft Kernel Streaming (KS) service driver — it manages
registry information for KS devices, caching **FilterData** and **Medium**
information and servicing KS property requests. It runs in kernel (SYSTEM), and
its property surface is reachable by an ordinary local user, so an
authorization flaw in its registry handling is a local EoP.

---

## Vulnerability Summary

Sending a `KSPROPERTY_SERVICE_BUILDCACHE` request invokes `PropertySrv` →
`UpdateMediumCache`, which walks a device's pins collecting **Medium** type
information. For **non-standard** Medium types it caches the data under
`HKLM\SYSTEM\CurrentControlSet\Control\MediumCache`. The flaw: it creates those
keys with **`ZwCreateKey` but without `OBJ_FORCE_ACCESS_CHECK`**, so the kernel
does not evaluate the *calling user's* access against the target — it creates in
the current-user context but with the driver's (SYSTEM) authority.

Because a standard user has "create subkey" rights under `MediumCache`, they own
the subkey they create and can place a **registry symbolic link** there. The
SYSTEM driver, following the symlink without an access check, then creates or
modifies the default value of an **arbitrary `HKLM` key** — a registry write
primitive that yields EoP.

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`).
- There is a hardware condition: the device must support **custom
  Medium pins** (not `KSMEDIUMSETID_Standard`) — typically professional /
  special-purpose hardware that excludes the standard medium set. This gates the
  non-standard-Medium caching path that reaches `ZwCreateKey`.
- Result is an attacker-directed `HKLM` key/value create via a registry symlink,
  from a standard user, executed with SYSTEM authority.

---

## Vulnerability Details

### Call Chain

```
Local user:
  DeviceIoControl(KS property, KSPROPERTY_SERVICE_BUILDCACHE)
    -> mskssrv!PropertySrv -> UpdateMediumCache (-> UpdateMediumCachePassive[_Do])
         for non-standard Medium types:
           ZwCreateKey(HKLM\...\MediumCache\<attacker subkey>)   // *** no OBJ_FORCE_ACCESS_CHECK ***
             -> follows attacker registry symlink -> arbitrary HKLM write
```

### Root Cause

`ZwCreateKey` is called without `OBJ_FORCE_ACCESS_CHECK`, so the create is
performed with the driver's privilege rather than the caller's, and no check
prevents following a user-planted registry symbolic link out of the writable
`MediumCache` subtree into a protected `HKLM` location (CWE-269/CWE-285). This is
the same missing-`OBJ_FORCE_ACCESS_CHECK` pattern behind other Windows
symlink/redirection EoPs.

### The patch (confirmed — diff, .7019 → .7171)

The November build reworks the Medium-cache registry path (`UpdateMediumCachePassive`
/ `UpdateMediumCachePassive_Do`) so the create is access-checked / not
symlink-followable when invoked on behalf of an unprivileged caller, gated behind
`Feature_3602159931` (the expected concrete change being the addition of
`OBJ_FORCE_ACCESS_CHECK` to the object attributes for the `ZwCreateKey` call).
With the flag disabled the original path still ships.

### Patch Completeness Assessment

**CFR-gated behind `Feature_3602159931`** — the corrected path runs only when the
flag is enabled; patch state is not determined by file version alone, consistent
with the runtime-gated pattern across this corpus.

---

## Detection Guidance

**Behavioural.** A standard user issuing KS `KSPROPERTY_SERVICE_BUILDCACHE` and
creating subkeys / registry symbolic links under
`HKLM\SYSTEM\CurrentControlSet\Control\MediumCache`, followed by SYSTEM writes to
unexpected `HKLM` locations.

**Registry.** Creation of registry symlinks (`REG_OPTION_CREATE_LINK`) under
`MediumCache`; new/modified default values in protected `HKLM` keys attributable
to the KS service. Auditing on `MediumCache` and sensitive target keys.

**Config.** Fix is CFR-gated — confirm `Feature_3602159931` is enabled.

---

## References

  Vulnerability* (t0zhang), CVE-2025-59514.
- MSRC advisory — CVE-2025-59514 (Microsoft Streaming Service Proxy EoP)
- Full binary diff: `/data/patch_diffs/mskssrv_sys-cve-2025-59514-ghidriff.md`
- Related pattern: OBJ_FORCE_ACCESS_CHECK / registry-symlink EoPs (CVE-2025-59512, CVE-2025-59511)