How safe is it for an application to use a handle that was opened without OBJ_KERNEL_HANDLE by driver?

NTDEV
1

I've been asking a lot of questions :sweat_smile:. Sorry if that disturbs or somehow "floods" the OSR.

This one is quite short and focused.

Microsoft always highlights usage of OBJ_KERNEL_HANDLE to keep it secure from the context of application made the I/O request. If not opened with OBJ_KERNEL_HANDLE, the application can use it and gain access.

My questions are:

  1. How safe is this for the application to use the handle?
  2. Can the application duplicate the handle?
    2.1. Will the duplicated handle remain valid when driver closes the original one via ZwClose?
  3. Can the application close handle by calling Close on kernel32.dll?
2

The documentation seems quite clear. If you use OBJ_KERNEL_HANDLE, then the handle only has meaning in kernel mode. A user-mode application cannot use it. It will be an invalid handle. If you don't use OBJ_KERNEL_HANDLE, then it is valid in user mode like any other handle.

There's no "safety" issue here. Either it is kernel-only, or it is not.

3

So I'm assuming all answers to my other questions are also yes:
(1) Application can close the handle via Close, (2) can duplicate it, (3) and can use the duplicated handle even if driver closes the original one with ZwClose?

4

Yes. Check here: Object Handles - Windows drivers | Microsoft Learn

The handle does not go away until that last reference is closed, just like all handles.

5

IIRC driver verifier will bugcheck you for not using safe handles.