NVIDIA Driver – Missing Bounds Check in Escape 0x100009a - 体验盒子

作者： Google Security Research

日期： 2016-10-31

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/40665/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=942

The DxgkDdiEscape handler for escape 0x100009a lacks proper bounds checks:

case 0x100009A:

...

size_0 = escape_data->size_1;

...

size_1 = 2 - (escape_data->unknown < 18);

...

size_2 = escape_data->size_2;

...

total_size = size_0 * size_1 * size_2;

...

if (total_size > 0x10)

do_debug_thingo();

if (total_size) {

DWORD* ptr = alloced_buf + 24;

DWORD* user_buf = escape_data->data;

...

while (total_size) {

*(ptr - 1) = *(user_buf - 1);

*ptr = *user_buf;

...

user_buf += 4;

ptr += 39;

--total_size;

}

There is a check that total_size > 0x10, which calls some kind of a

debug/logging function (do_debug_thingo in my pseudocode), but it does not

actually stop processing of the escape. This leads to buffer overflow on the

allocated pool buffer later on.

Note that there is also a potential integer overflow in the calculation of

|total_size|. Since the individual sizes (size_0, size_1, size_2) appear to be

stored in a struct and eventually passed off to another function, there may be