Skip to content

Commit df65387

Browse files
splintersfuryclaude
splintersfury
and
claude
committed
Update corpus analytics charts and stats for 147-CVE corpus
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 5ddb4aa commit df65387

1 file changed

Lines changed: 59 additions & 59 deletions

File tree

‎docs/guides/corpus-analytics.md‎

Lines changed: 59 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,40 @@
11
# Corpus Analytics
22

3-
> Visual breakdown of 134 CVEs across 62 drivers -- what gets exploited, how often, and where the patterns cluster.
3+
> Visual breakdown of 147 CVEs across 64 drivers -- what gets exploited, how often, and where the patterns cluster.
44
55
## CVEs by Driver Family
66

7-
The top 10 driver families account for roughly 75% of the corpus. Four families -- afd.sys, clfs.sys, win32k, and the Kernel Streaming stack -- share the lead at 12--13 CVEs each.
7+
The top 10 driver families account for roughly 68% of the corpus. clfs.sys leads at 15, followed by ntoskrnl.exe and the Kernel Streaming stack at 14 each, then afd.sys at 13.
88

99
<div class="ks-figure" markdown>
1010
<span class="ks-figure-label">FIG — CVEs by Driver Family (Top 10)</span>
1111
<svg viewBox="0 0 700 340" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Horizontal bar chart showing CVE counts by driver family">
12-
<!-- afd.sys -->
13-
<text class="ks-label" x="175" y="35" text-anchor="end">afd.sys</text>
14-
<rect class="ks-box" x="180" y="22" width="338" height="20" rx="0"/>
15-
<text class="ks-annotation" x="526" y="36">13</text>
1612
<!-- clfs.sys -->
17-
<text class="ks-label" x="175" y="65" text-anchor="end">clfs.sys</text>
18-
<rect class="ks-box" x="180" y="52" width="312" height="20" rx="0"/>
19-
<text class="ks-annotation" x="500" y="66">12</text>
20-
<!-- win32k family -->
21-
<text class="ks-label" x="175" y="95" text-anchor="end">win32k family</text>
22-
<rect class="ks-box" x="180" y="82" width="312" height="20" rx="0"/>
23-
<text class="ks-annotation" x="500" y="96">12</text>
24-
<!-- Kernel Streaming -->
25-
<text class="ks-label" x="175" y="125" text-anchor="end">KS stack</text>
26-
<rect class="ks-box" x="180" y="112" width="312" height="20" rx="0"/>
27-
<text class="ks-annotation" x="500" y="126">12</text>
13+
<text class="ks-label" x="175" y="35" text-anchor="end">clfs.sys</text>
14+
<rect class="ks-box" x="180" y="22" width="390" height="20" rx="0"/>
15+
<text class="ks-annotation" x="578" y="36">15</text>
2816
<!-- ntoskrnl -->
29-
<text class="ks-label" x="175" y="155" text-anchor="end">ntoskrnl.exe</text>
30-
<rect class="ks-box" x="180" y="142" width="234" height="20" rx="0"/>
31-
<text class="ks-annotation" x="422" y="156">9</text>
32-
<!-- dwmcore.dll -->
33-
<text class="ks-label" x="175" y="185" text-anchor="end">dwmcore.dll</text>
34-
<rect class="ks-box" x="180" y="172" width="208" height="20" rx="0"/>
35-
<text class="ks-annotation" x="396" y="186">8</text>
17+
<text class="ks-label" x="175" y="65" text-anchor="end">ntoskrnl.exe</text>
18+
<rect class="ks-box" x="180" y="52" width="364" height="20" rx="0"/>
19+
<text class="ks-annotation" x="552" y="66">14</text>
20+
<!-- Kernel Streaming -->
21+
<text class="ks-label" x="175" y="95" text-anchor="end">KS stack</text>
22+
<rect class="ks-box" x="180" y="82" width="364" height="20" rx="0"/>
23+
<text class="ks-annotation" x="552" y="96">14</text>
24+
<!-- afd.sys -->
25+
<text class="ks-label" x="175" y="125" text-anchor="end">afd.sys</text>
26+
<rect class="ks-box" x="180" y="112" width="338" height="20" rx="0"/>
27+
<text class="ks-annotation" x="526" y="126">13</text>
28+
<!-- win32k family -->
29+
<text class="ks-label" x="175" y="155" text-anchor="end">win32k family</text>
30+
<rect class="ks-box" x="180" y="142" width="312" height="20" rx="0"/>
31+
<text class="ks-annotation" x="500" y="156">12</text>
3632
<!-- cldflt.sys -->
37-
<text class="ks-label" x="175" y="215" text-anchor="end">cldflt.sys</text>
33+
<text class="ks-label" x="175" y="185" text-anchor="end">cldflt.sys</text>
34+
<rect class="ks-box" x="180" y="172" width="234" height="20" rx="0"/>
35+
<text class="ks-annotation" x="422" y="186">9</text>
36+
<!-- dwmcore.dll -->
37+
<text class="ks-label" x="175" y="215" text-anchor="end">dwmcore.dll</text>
3838
<rect class="ks-box" x="180" y="202" width="208" height="20" rx="0"/>
3939
<text class="ks-annotation" x="396" y="216">8</text>
4040
<!-- ntfs.sys -->
@@ -50,7 +50,7 @@ The top 10 driver families account for roughly 75% of the corpus. Four families
5050
<rect class="ks-box" x="180" y="292" width="78" height="20" rx="0"/>
5151
<text class="ks-annotation" x="266" y="306">3</text>
5252
</svg>
53-
<p class="ks-figure-caption">"win32k family" combines win32k.sys, win32kbase.sys, and win32kfull.sys. "KS stack" combines ks.sys, ksthunk.sys, and mskssrv.sys. Remaining 44 CVEs span 52 additional drivers.</p>
53+
<p class="ks-figure-caption">"win32k family" combines win32k.sys, win32kbase.sys, and win32kfull.sys. "KS stack" combines ks.sys, ksthunk.sys, and mskssrv.sys. Remaining 47 CVEs span 54 additional drivers.</p>
5454
</div>
5555

5656
## Kernel CVE Volume by Year
@@ -147,40 +147,40 @@ Buffer overflows are most common, followed closely by use-after-free, which domi
147147
<svg viewBox="0 0 700 340" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Horizontal bar chart showing vulnerability class distribution">
148148
<!-- Buffer Overflow -->
149149
<text class="ks-label" x="175" y="35" text-anchor="end">Buffer Overflow</text>
150-
<rect class="ks-box" x="180" y="22" width="240" height="20" rx="0"/>
151-
<text class="ks-annotation" x="428" y="36">30</text>
150+
<rect class="ks-box" x="180" y="22" width="248" height="20" rx="0"/>
151+
<text class="ks-annotation" x="436" y="36">31</text>
152152
<!-- Use-After-Free -->
153153
<text class="ks-label" x="175" y="65" text-anchor="end">Use-After-Free</text>
154-
<rect class="ks-box" x="180" y="52" width="200" height="20" rx="0"/>
155-
<text class="ks-annotation" x="388" y="66">25</text>
154+
<rect class="ks-box" x="180" y="52" width="208" height="20" rx="0"/>
155+
<text class="ks-annotation" x="396" y="66">26</text>
156156
<!-- Arbitrary R/W -->
157157
<text class="ks-label" x="175" y="95" text-anchor="end">Arbitrary R/W</text>
158-
<rect class="ks-box" x="180" y="82" width="168" height="20" rx="0"/>
159-
<text class="ks-annotation" x="356" y="96">21</text>
158+
<rect class="ks-box" x="180" y="82" width="176" height="20" rx="0"/>
159+
<text class="ks-annotation" x="364" y="96">22</text>
160160
<!-- EoP (generic) -->
161161
<text class="ks-label" x="175" y="125" text-anchor="end">EoP (generic)</text>
162-
<rect class="ks-box" x="180" y="112" width="144" height="20" rx="0"/>
163-
<text class="ks-annotation" x="332" y="126">18</text>
162+
<rect class="ks-box" x="180" y="112" width="160" height="20" rx="0"/>
163+
<text class="ks-annotation" x="348" y="126">20</text>
164164
<!-- Race Condition -->
165165
<text class="ks-label" x="175" y="155" text-anchor="end">Race Condition</text>
166-
<rect class="ks-box" x="180" y="142" width="96" height="20" rx="0"/>
167-
<text class="ks-annotation" x="284" y="156">12</text>
166+
<rect class="ks-box" x="180" y="142" width="112" height="20" rx="0"/>
167+
<text class="ks-annotation" x="300" y="156">14</text>
168+
<!-- Logic Bug -->
169+
<text class="ks-label" x="175" y="185" text-anchor="end">Logic / Other</text>
170+
<rect class="ks-box" x="180" y="172" width="80" height="20" rx="0"/>
171+
<text class="ks-annotation" x="268" y="186">10</text>
168172
<!-- Info Disclosure -->
169-
<text class="ks-label" x="175" y="185" text-anchor="end">Info Disclosure</text>
170-
<rect class="ks-box" x="180" y="172" width="64" height="20" rx="0"/>
171-
<text class="ks-annotation" x="252" y="186">8</text>
173+
<text class="ks-label" x="175" y="215" text-anchor="end">Info Disclosure</text>
174+
<rect class="ks-box" x="180" y="202" width="64" height="20" rx="0"/>
175+
<text class="ks-annotation" x="252" y="216">8</text>
172176
<!-- Type Confusion -->
173-
<text class="ks-label" x="175" y="215" text-anchor="end">Type Confusion</text>
174-
<rect class="ks-box" x="180" y="202" width="40" height="20" rx="0"/>
175-
<text class="ks-annotation" x="228" y="216">5</text>
177+
<text class="ks-label" x="175" y="245" text-anchor="end">Type Confusion</text>
178+
<rect class="ks-box" x="180" y="232" width="48" height="20" rx="0"/>
179+
<text class="ks-annotation" x="236" y="246">6</text>
176180
<!-- Integer Overflow -->
177-
<text class="ks-label" x="175" y="245" text-anchor="end">Integer Overflow</text>
178-
<rect class="ks-box" x="180" y="232" width="32" height="20" rx="0"/>
179-
<text class="ks-annotation" x="220" y="246">4</text>
180-
<!-- Logic Bug -->
181-
<text class="ks-label" x="175" y="275" text-anchor="end">Logic / Other</text>
182-
<rect class="ks-box" x="180" y="262" width="56" height="20" rx="0"/>
183-
<text class="ks-annotation" x="244" y="276">7</text>
181+
<text class="ks-label" x="175" y="275" text-anchor="end">Integer Overflow</text>
182+
<rect class="ks-box" x="180" y="262" width="48" height="20" rx="0"/>
183+
<text class="ks-annotation" x="236" y="276">6</text>
184184
<!-- Process Termination -->
185185
<text class="ks-label" x="175" y="305" text-anchor="end">Process Kill</text>
186186
<rect class="ks-box" x="180" y="292" width="32" height="20" rx="0"/>
@@ -192,12 +192,12 @@ Buffer overflows are most common, followed closely by use-after-free, which domi
192192
## Exploitation Status
193193

194194
<div class="ks-stats-box" markdown>
195-
<span class="ks-stat-num">52</span> exploited in the wild &nbsp;&middot;&nbsp;
196-
<span class="ks-stat-num">82</span> not exploited ITW<br>
195+
<span class="ks-stat-num">57</span> exploited in the wild &nbsp;&middot;&nbsp;
196+
<span class="ks-stat-num">90</span> not exploited ITW<br>
197197
<span class="ks-stat-num">2</span> remotely exploitable &nbsp;&middot;&nbsp;
198-
<span class="ks-stat-num">132</span> local only<br>
198+
<span class="ks-stat-num">145</span> local only<br>
199199
<span class="ks-stat-num">41</span> third-party BYOVD drivers &nbsp;&middot;&nbsp;
200-
<span class="ks-stat-num">93</span> Microsoft inbox drivers
200+
<span class="ks-stat-num">106</span> Microsoft inbox drivers
201201
</div>
202202

203203
Nearly 39% of the corpus has been exploited in the wild. The two remote CVEs are [CVE-2022-21907](../case-studies/CVE-2022-21907.md) (http.sys) and [CVE-2024-38063](../case-studies/CVE-2024-38063.md) (tcpip.sys). Everything else requires local access or a BYOVD drop.
@@ -210,22 +210,22 @@ Where do specific bug types concentrate? This table crosses the top 8 driver fam
210210

211211
| Driver | Buf Ovf | UAF | Race | Type Conf | Info Disc | Arb R/W | Int Ovf | Other |
212212
|--------|---------|-----|------|-----------|-----------|---------|---------|-------|
213+
| **clfs.sys** | 8 | 2 | | 1 | | | | 4 |
214+
| **ntoskrnl** | | 2 | 3 | | 2 | 1 | 2 | 4 |
213215
| **afd.sys** | 1 | 7 | 3 | | | | 1 | 1 |
214-
| **clfs.sys** | 7 | 2 | | | | | | 3 |
215216
| **win32k** | | 5 | 3 | 2 | 1 | | | 1 |
216-
| **KS stack** | 4 | 2 | | 1 | | | 1 | 4 |
217-
| **ntoskrnl** | | 1 | 3 | | 2 | | 1 | 2 |
217+
| **KS stack** | 4 | 2 | 1 | 1 | | | 2 | 4 |
218+
| **cldflt** | 3 | 2 | 2 | | | | | 2 |
218219
| **dwmcore** | 2 | 1 | | 1 | | | | 4 |
219-
| **cldflt** | 3 | 2 | 1 | | | | | 2 |
220220
| **ntfs** | 3 | | | | 3 | | | 1 |
221221

222222
Notable clusters:
223223

224+
- **clfs.sys skews buffer overflow.** Corrupt on-disk offsets cause OOB writes in the BLF parser, accounting for 8 of 15 CVEs.
224225
- **afd.sys skews UAF.** Socket teardown races account for 7 of 13 CVEs.
225-
- **clfs.sys skews buffer overflow.** Corrupt on-disk offsets cause OOB writes in the BLF parser.
226+
- **ntoskrnl.exe spreads across classes.** Registry races, UAF, integer overflow, arb R/W, and logic bugs -- no single dominant class across 14 CVEs.
226227
- **win32k splits between UAF and races.** Callback reentrancy and concurrent window ops feed both.
227228
- **ntfs.sys splits between buffer overflow and info disclosure.** Crafted VHD images hit both through MFT parsing.
228-
- **ntoskrnl.exe leans toward races.** Token and secure-mode operations lack proper locking.
229229

230230
## Cross-References
231231

0 commit comments

Comments
 (0)