0ΡΑΔΔΙΣ

A researcher discovered a vulnerability in ETW, the Event Tracing for Windows system that underpins most of Windows’ security tooling. The bug caused a kernel pointer to be returned to usermode callers. Microsoft had tried to fix the issue by zeroing out the pointer, but they used a 4-byte write instead of clearing the full 8-byte value. This left the upper half of the kernel address intact and fully leakable. The researcher reported the bug. Microsoft initially classified it as Important but refused to pay a bounty for it. Later they marked it as “won’t fix.” The researcher noted that fixing the issue would have taken less time than writing the email declining to address it. It was eventually assigned CVE-2021-24107 and patched.

Windows has an undocumented kernel function called MiReadWriteVirtualMemory. It's what NtReadVirtualMemory and NtWriteVirtualMemory actually call under the hood. It checks two bit flags inside the EPROCESS structure, EnableReadVmLogging and EnableWriteVmLogging, at offset 0x1F0, to decide whether to log the memory operation to ETW. Those bits are not set by default. Attackers who know the offset can clear them and perform memory operations that never appear in any EDR telemetry. The function isn't in any public documentation. You find it by reading the disassembly.