Exploiting Windows KTM – Part 1/5

This multi-part blog series analyzes CVE-2018-8611, a Windows Kernel Transaction Manager (KTM) race-condition local privilege escalation detected in the wild by Kaspersky and patched by Microsoft in December 2018. The authors reverse-engineer KTM internals, explain relevant kernel structures and APIs, analyze the patch, and describe development of a reliable exploit usable as a sandbox escape across Windows Vista through Windows 10 (including test environment and implementation details).