Hunting for Blues – the WSL Plan 9 Protocol BSOD

McAfee Labs analysed the Windows WSL Plan 9 (P9) protocol implementation and found that a malicious P9 server (by hijacking the "fsserver" AF_UNIX socket) can send malformed R-messages that the p9rdr.sys driver processes in kernel context, resulting in local denial-of-service (BSOD). The issue requires local presence or privileged actions to enable WSL/socket hijack, does not enable kernel code execution or privilege escalation, and Microsoft validated the findings with mitigations focused on preventing socket hijacking.