Windows HTTP Stack Exploit Attempt - CVE-2022-21907

The HTTP Protocol Stack (HTTP.sys) is a kernel-mode device driver in Windows devices responsible for processing inbound HTTP requests and creating outbound HTTP responses. For example, HTTP.sys provides web server functionality to internet-facing applications such as Internet Information Services (IIS), Exchange, and Sharepoint. A vulnerability exists in how HTTP.sys processes incoming HTTP requests. An attacker crafts a sequence of HTTP requests to send to the vulnerable server. The sequence begins with several HTTP GET requests that have large headers. The sequence is completed with a malformed HTTP GET request that is missing an HTTP version token at the end of the request. HTTP.sys incorrectly processes the last malformed request in a way that corrupts a critical data structure in the kernel. The corrupt data structure can cause a denial of service (DoS) and potentially lead to remote command execution (RCE).