发布 2016-10-31 漏洞条目

NVIDIA Driver – Missing Bounds Check in Escape 0x100009a

Exploit Source

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=942

The DxgkDdiEscape handler for escape 0x100009a lacks proper bounds checks:

case 0x100009A:

...

size_0 = escape_data->size_1;

...

size_1 = 2 - (escape_data->unknown < 18);

...

size_2 = escape_data->size_2;

...

total_size = size_0 * size_1 * size_2;

...

if (total_size > 0x10)

do_debug_thingo();

if (total_size) {

DWORD* ptr = alloced_buf + 24;

DWORD* user_buf = escape_data->data;

...

while (total_size) {

*(ptr - 1) = *(user_buf - 1);

*ptr = *user_buf;

...

user_buf += 4;

ptr += 39;

--total_size;

}

There is a check that total_size > 0x10, which calls some kind of a

debug/logging function (do_debug_thingo in my pseudocode), but it does not

actually stop processing of the escape. This leads to buffer overflow on the

allocated pool buffer later on.

Note that there is also a potential integer overflow in the calculation of

|total_size|. Since the individual sizes (size_0, size_1, size_2) appear to be

stored in a struct and eventually passed off to another function, there may be

相关漏洞条目