Processes within the sandbox are permitted to use NtQuerySystemInformation to read kernel addresses.

[nek0y4nsu]

Some attackers exploit privilege escalation vulnerabilities by using NtQuerySystemInformation to leak kernel addresses. Is there a way to prevent programs within Sandboxie from using NtQuerySystemInformation?
Test on 10.0.17763 Build 17763 （Windows 10）

SystemHandleInformation
SystemLockInformation
SystemModuleInformation
SystemProcessInformation
SystemBigPoolInformation

[e-t-l]

You may want to open a full bug report about this, if not perhaps a security report

[diversenok]

Newer OS versions already have a built-in mitigation that erases kernel addresses from these info class' output buffers. It might be nice to back-port it to older versions, but that's not a vulnerability by any means.

[e-t-l]

That's good to hear!

[bastik-1001]

There is a feature request for it. #5133