G Data TotalCare 2011 – ‘NtOpenKey’ Race Condition
1.Description: The HookCentre.sys kernel driver distributed with G Data TotalCare 2011 contains a race condition vulnerability in the handling arguments of NtOpenkey function. Exploitation of this issue allows an attacker to crash system(make infamous BSoD) or gain escalated priviligies. An attacker would need local access to a vulnerable computer to exploit this vulnerability. Affected application: G Data TotalCare 2011, up to date version 21.1.0.5. Affected file: HookCentre.sys version 10.0.8.11. 2.Crash dump info: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: 90909090, memory referenced. Arg2: 00000000, value 0 = read operation, 1 = write operation. Arg3: 80536913, If non-zero, the instruction address which referenced the bad memory address. Arg4: 00000000, (reserved) Debugging Details: ------------------ READ_ADDRESS: 90909090 FAULTING_IP: nt!memcpy+33 80536913 f3a5 rep movs dword ptr es:[edi],dword ptr [esi] MM_INTERNAL_CODE: 0 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: hookfuzz.exe TRAP_FRAME: f06f7c24 -- (.trap 0xfffffffff06f7c24) ErrCode = 00000000 eax=909090ea ebx=0012ff08 ecx=00000016 edx=00000002 esi=90909090 edi=81ae5d2c eip=80536913 esp=f06f7c98 ebp=f06f7ca0 iopl=0 nv up ei pl nz ac po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010212 nt!memcpy+0x33: 80536913 f3a5 rep movs dword ptr es:[edi],dword ptr [esi] Resetting default scope LAST_CONTROL_TRANSFER: from 804f7b9d to 80527bdc STACK_TEXT: f06f7760 804f7b9d 00000003 90909090 00000000 nt!RtlpBreakWithStatusInstruction f06f77ac 804f878a 00000003 00000000 c0484848 nt!KiBugCheckDebugBreak+0x19 f06f7b8c 804f8cb5 00000050 90909090 00000000 nt!KeBugCheck2+0x574 f06f7bac 8051cc4f 00000050 90909090 00000000 nt!KeBugCheckEx+0x1b f06f7c0c 8054051c 00000000 90909090 00000000 nt!MmAccessFault+0x8e7 f06f7c0c 80536913 00000000 90909090 00000000 nt!KiTrap0E+0xcc f06f7ca0 f9cbc7d5 81ae5d2c 90909090 0000005a nt!memcpy+0x33 WARNING: Stack unwind information not available. Following frames may be wrong. f06f7cc0 f9cbd818 0012ff08 0012ff08 00000000 HookCentre+0x7d5 f06f7cd8 f9cbddd2 00000001 00000188 000006cc HookCentre+0x1818 f06f7d28 f9cbe50b 00000188 000006cc 000007d8 HookCentre+0x1dd2 f06f7d50 8053d638 0012ff04 00020000 00000000 HookCentre+0x250b f06f7d50 7c90e4f4 0012ff04 00020000 00000000 nt!KiFastCallEntry+0xf8 0012fec4 7c90d5bc 004010d0 0012ff04 00020000 ntdll!KiFastSystemCallRet 0012fec8 004010d0 0012ff04 00020000 0012feec ntdll!ZwOpenKey+0xc 0012ff70 00401622 00000001 00342e68 00342e98 hookfuzz!wmain+0xd0 0012ffc0 7c817067 fdd46ae8 01cb4211 7ffdd000 hookfuzz!__tmainCRTStartup+0x15e 0012fff0 00000000 00401679 00000000 78746341 kernel32!BaseProcessStart+0x23 STACK_COMMAND: kb FOLLOWUP_IP: HookCentre+7d5 f9cbc7d5 83c40c add esp,0Ch SYMBOL_STACK_INDEX: 7 SYMBOL_NAME: HookCentre+7d5 FOLLOWUP_NAME: MachineOwner MODULE_NAME: HookCentre IMAGE_NAME: HookCentre.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4c75a6b8 FAILURE_BUCKET_ID: 0x50_HookCentre+7d5 BUCKET_ID: 0x50_HookCentre+7d5 Followup: MachineOwner --------- 3.PoC is in NtOpenKey_poc.zip file. https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15444.zip (NtOpenKey_poc.zip) |