From 36c20dc56ba225643eec76866f4a95cdbea219b1 Mon Sep 17 00:00:00 2001 From: Pierre Schweitzer Date: Fri, 10 Aug 2018 08:01:31 +0200 Subject: [PATCH] [NTOSKRNL] Deny page file creation on floppy disk --- ntoskrnl/mm/pagefile.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/ntoskrnl/mm/pagefile.c b/ntoskrnl/mm/pagefile.c index 1ea1f073022..7e73002153c 100644 --- a/ntoskrnl/mm/pagefile.c +++ b/ntoskrnl/mm/pagefile.c @@ -504,6 +504,7 @@ NtCreatePagingFile(IN PUNICODE_STRING FileName, KPROCESSOR_MODE PreviousMode; UNICODE_STRING CapturedFileName; LARGE_INTEGER SafeInitialSize, SafeMaximumSize, AllocationSize; + FILE_FS_DEVICE_INFORMATION FsDeviceInfo; DPRINT("NtCreatePagingFile(FileName %wZ, InitialSize %I64d)\n", FileName, InitialSize->QuadPart); @@ -660,6 +661,16 @@ NtCreatePagingFile(IN PUNICODE_STRING FileName, return(Status); } + /* Deny page file creation on a floppy disk */ + FsDeviceInfo.Characteristics = 0; + IoQueryVolumeInformation(FileObject, FileFsDeviceInformation, sizeof(FsDeviceInfo), &FsDeviceInfo, &Count); + if (BooleanFlagOn(FsDeviceInfo.Characteristics, FILE_FLOPPY_DISKETTE)) + { + ObDereferenceObject(FileObject); + ZwClose(FileHandle); + return STATUS_FLOPPY_VOLUME; + } + CurrentRetDescList = RetDescList = MmAllocRetrievelDescriptorList(PAIRS_PER_RUN); if (CurrentRetDescList == NULL)