CA Internet Security Suite 2010 – ‘KmxSbx.sys’ Kernel Pool Overflow
/* # Exploit Title: CA Internet Security Suite 2010 KmxSbx.sys Kernel Pool Overflow 0-day Exploit # Date: 2010-11-28 # Author: Nikita Tarakanov (CISS Research Team) # Software Link: http://shop.ca.com/ca/products/internetsecurity/internetsecurity_suite.asp # Version: up to date, KmxSbx.sys version 6.2.0.22 # Tested on: Win XP SP3 # CVE : CVE-NO-MATCH # Status : Unpatched */ 1.Description: The KmxSbx.sys kernel driver distributed with CA Security Suite contains a pool corruption vulnerability in the handling of IOCTL 0x88000080. Exploitation of this issue allows an attacker to execute arbitrary code within the kernel. An attacker would need local access to a vulnerable computer to exploit this vulnerability. Affected application: CA Internet Security Suite 2010. Affected file: KmxSbx.sys version 6.2.0.22. 2.Vulnerability details: [..] .text:00016330 mov cx, [eax] ; eax points to attacker controlled data .text:00016333 inc eax .text:00016334 inc eax .text:00016335 test cx, cx .text:00016338 jnz short loc_16330 .text:0001633A sub eax, edx .text:0001633C sar eax, 1 .text:0001633E lea eax, [eax+eax+50h] ; size of UNICODE string + 0x50 bytes .text:00016342 movzx edi, ax ; integer wrap here! .text:00016345 .text:00016345 loc_16345: ; CODE XREF: sub_162D8+53j .text:00016345 movzx eax, di .text:00016348 push ebx .text:00016349 xor ebx, ebx .text:0001634B cmp eax, ebx .text:0001634D jz short loc_16359 .text:0001634F push eax ; NumberOfBytes .text:00016350 push ebx ; PoolType .text:00016351 call ds:ExAllocatePool ; Miscalculated Pool!!! .text:00016357 mov ebx, eax [..] .text:000163A6 movzx esi, word ptr [edx] .text:000163A9 mov [eax+edx], si ; Pool overflow here! .text:000163AD inc edx .text:000163AE inc edx .text:000163AF test si, si 3.Exploitation: 1.To exploit this vulnerability we have to allocate shellcode at some address, craft fake chunk header, that creates write4 primitive. 2.To invoke our shellcode we have to set such values in Flink,Blink, that points to some pointer in kernel space, and address of our r0 shellcode.When unlinking happens, we overwrite pointer in kernel space, and force execution with kernel priviligies(cpl==0). *3.Pool repair Exploit code is in CAInternetSecuritySuite2010.zip file. https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15624.zip (CAInternetSecuritySuite2010.zip) |