Introducing a New Vulnerability Class: False File Immutability

This report analyzes a Windows kernel vulnerability class named "False File Immutability," showing how incorrect assumptions about file immutability during paging and over network redirectors can be exploited to modify in-use PE files and achieve arbitrary kernel-level code execution (including bypassing Protected Process Light protections). The authors present two public PoCs (PPLFault and ItsNotASecurityBoundary), detail attack primitives (page-fault races, double-read/double-fetch), discuss exploitation methodology and mitigation strategies (e.g., MmProbeAndLockPages, ExAllocatePool, HVCI), and summarize coordination and patches released by Microsoft in 2024.