Sheep's Clothing, Wolf's Data: Detecting Server-Induced Client Vulnerabilities in IPC

The Windows operating system employs various inter-process communication (IPC) mechanisms, typically involving a privileged server and a less privileged client.However, scenarios exist where the client has higher privileges, such as a performance monitor running as a domain controller obtaining data from a domain member via IPC.In these cases, the server can be compromised and send crafted data to the client.Despite the increase in Windows client applications, existing research has overlooked potential client-side vulnerabilities, which can be equally harmful.This paper introduces GLEIPNIR, the first vulnerability detection tool for Windows remote IPC clients.GLEIPNIR identifies client-side vulnerabilities by fuzzing IPC call return values and introduces a snapshot technology to enhance testing efficiency.Experiments on 76 client applications demonstrate that GLEIPNIR can identify 25 vulnerabilities within 7 days, resulting in 14 CVEs and a bounty of $36,000.