Index: include/ndk/obtypes.h
===================================================================
--- include/ndk/obtypes.h	(revision 69327)
+++ include/ndk/obtypes.h	(working copy)
@@ -86,6 +86,12 @@
 #else
 
 //
+// Undocumented Attribute for Kernel-Only Access
+//
+#define OBJ_KERNEL_EXCLUSIVE                    0x00010000L
+#define OBJ_VALID_KERNEL_ATTRIBUTES             (OBJ_VALID_ATTRIBUTES | \
+                                                 OBJ_KERNEL_EXCLUSIVE)
+//
 // Object Flags
 //
 #define OB_FLAG_CREATE_INFO                     0x01
@@ -97,6 +103,11 @@
 #define OB_FLAG_SINGLE_PROCESS                  0x40
 #define OB_FLAG_DEFER_DELETE                    0x80
 
+//
+// Object Flags encoded in "QueryReferences" field
+//
+#define OB_FLAG_KERNEL_EXCLUSIVE                0x40000000
+
 #define OBJECT_TO_OBJECT_HEADER(o)                          \
     CONTAINING_RECORD((o), OBJECT_HEADER, Body)
 
Index: ntoskrnl/include/internal/ob_x.h
===================================================================
--- ntoskrnl/include/internal/ob_x.h	(revision 69327)
+++ ntoskrnl/include/internal/ob_x.h	(working copy)
@@ -19,6 +19,24 @@
 
 FORCEINLINE
 ULONG
+ObpValidateAttributes(IN ULONG Attributes,
+                      IN KPROCESSOR_MODE PreviousMode)
+{
+    if (PreviousMode == KernelMode)
+    {
+        /* For kernel, allow any valid attributes */
+        return Attributes & OBJ_VALID_KERNEL_ATTRIBUTES;
+    }
+    else
+    {
+        /* For user, mask out kernel-only attributes */
+        return (Attributes & OBJ_VALID_ATTRIBUTES) &
+               ~(OBJ_KERNEL_HANDLE);
+    }
+}
+
+FORCEINLINE
+ULONG
 ObpSelectObjectLockSlot(IN POBJECT_HEADER ObjectHeader)
 {
     /* We have 4 locks total, this will return a 0-index slot */
Index: ntoskrnl/mm/section.c
===================================================================
--- ntoskrnl/mm/section.c	(revision 69327)
+++ ntoskrnl/mm/section.c	(working copy)
@@ -2756,7 +2756,7 @@
     SectionSize.QuadPart = 0xFFFFFFFF;
     InitializeObjectAttributes(&Obj,
                                &Name,
-                               OBJ_PERMANENT,
+                               OBJ_PERMANENT | OBJ_KERNEL_EXCLUSIVE,
                                NULL,
                                NULL);
     Status = MmCreateSection((PVOID)&PhysSection,
Index: ntoskrnl/ob/obhandle.c
===================================================================
--- ntoskrnl/ob/obhandle.c	(revision 69327)
+++ ntoskrnl/ob/obhandle.c	(working copy)
@@ -871,6 +871,16 @@
         Status = STATUS_ACCESS_DENIED;
         goto Quickie;
     }
+    
+    /* Check for exclusive kernel object */
+    if ((OBJECT_HEADER_TO_NAME_INFO(ObjectHeader)->QueryReferences &
+         OB_FLAG_KERNEL_EXCLUSIVE) &&
+        (ProbeMode != KernelMode))
+    {
+        /* Caller is not kernel, but the object is kernel exclusive */
+        Status = STATUS_ACCESS_DENIED;
+        goto Quickie;
+    }
 
     /*
      * Check if this is an object that went from 0 handles back to existence,
Index: ntoskrnl/ob/oblife.c
===================================================================
--- ntoskrnl/ob/oblife.c	(revision 69327)
+++ ntoskrnl/ob/oblife.c	(working copy)
@@ -731,10 +731,10 @@
         /* Check if this is a call with the special protection flag */
         if ((PreviousMode == KernelMode) &&
             (ObjectCreateInfo) &&
-            (ObjectCreateInfo->Attributes & 0x10000))
+            (ObjectCreateInfo->Attributes & OBJ_KERNEL_EXCLUSIVE))
         {
             /* Set flag which will make the object protected from user-mode */
-            NameInfo->QueryReferences |= 0x40000000;
+            NameInfo->QueryReferences |= OB_FLAG_KERNEL_EXCLUSIVE;
         }
 
         /* Set the header pointer */
Index: ntoskrnl/ob/obname.c
===================================================================
--- ntoskrnl/ob/obname.c	(revision 69327)
+++ ntoskrnl/ob/obname.c	(working copy)
@@ -261,14 +261,14 @@
                     ObpDeleteSymbolicLinkName(Object);
                 }
 
-                /* Check if the magic protection flag is set */
+                /* Check if the kernel exclusive is set */
                 ObjectNameInfo = OBJECT_HEADER_TO_NAME_INFO(ObjectHeader);
                 if ((ObjectNameInfo) &&
-                    (ObjectNameInfo->QueryReferences & 0x40000000))
+                    (ObjectNameInfo->QueryReferences & OB_FLAG_KERNEL_EXCLUSIVE))
                 {
                     /* Remove protection flag */
                     InterlockedExchangeAdd((PLONG)&ObjectNameInfo->QueryReferences,
-                                           -0x40000000);
+                                           -OB_FLAG_KERNEL_EXCLUSIVE);
                 }
 
                 /* Get the directory */
Index: ntoskrnl/ps/process.c
===================================================================
--- ntoskrnl/ps/process.c	(revision 69327)
+++ ntoskrnl/ps/process.c	(working copy)
@@ -1483,7 +1483,9 @@
                          sizeof(OBJECT_ATTRIBUTES),
                          sizeof(ULONG));
             HasObjectName = (ObjectAttributes->ObjectName != NULL);
-            Attributes = ObjectAttributes->Attributes;
+
+            /* Validate user attributes */
+            Attributes = ObpValidateAttributes(ObjectAttributes->Attributes, PreviousMode);
         }
         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
         {
@@ -1496,7 +1498,9 @@
     {
         /* Otherwise just get the data directly */
         HasObjectName = (ObjectAttributes->ObjectName != NULL);
-        Attributes = ObjectAttributes->Attributes;
+
+        /* Still sanitize valid attributes */
+        Attributes = ObpValidateAttributes(ObjectAttributes->Attributes, PreviousMode);
     }
 
     /* Can't pass both, fail */
Index: ntoskrnl/ps/thread.c
===================================================================
--- ntoskrnl/ps/thread.c	(revision 69327)
+++ ntoskrnl/ps/thread.c	(working copy)
@@ -1054,7 +1054,9 @@
                          sizeof(OBJECT_ATTRIBUTES),
                          sizeof(ULONG));
             HasObjectName = (ObjectAttributes->ObjectName != NULL);
-            Attributes = ObjectAttributes->Attributes;
+
+            /* Validate user attributes */
+            Attributes = ObpValidateAttributes(ObjectAttributes->Attributes, PreviousMode);
         }
         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
         {
@@ -1067,7 +1069,9 @@
     {
         /* Otherwise just get the data directly */
         HasObjectName = (ObjectAttributes->ObjectName != NULL);
-        Attributes = ObjectAttributes->Attributes;
+
+        /* Still have to sanitize attributes */
+        Attributes = ObpValidateAttributes(ObjectAttributes->Attributes, PreviousMode);
     }
 
     /* Can't pass both, fail */
Index: ntoskrnl/se/token.c
===================================================================
--- ntoskrnl/se/token.c	(revision 69327)
+++ ntoskrnl/se/token.c	(working copy)
@@ -2952,6 +2952,9 @@
         _SEH2_END;
     }
 
+    /* Validate object attributes */
+    HandleAttributes = ObpValidateAttributes(HandleAttributes, PreviousMode);
+
     /*
      * At first open the thread token for information access and verify
      * that the token associated with thread is valid.