Windows NTFS Kernel Exploit with WNF (Part 1)

This blog post analyzes CVE-2021-31956, a Windows NTFS local privilege-escalation vulnerability patched in June 2021, showing how crafted NTFS extended attributes trigger an underflow that copies attacker-controlled data out-of-bounds. The author details exploitation constraints, kernel paged-pool layout, and how the Windows Notification Facility (WNF) can be abused to obtain controlled paged-pool allocations, frees, relative reads/writes, and demonstrates steps toward corrupting EPROCESS structures and achieving privilege escalation, while discussing mitigations and future reliability work.