lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 17 Jan 2010 01:53:48 +0100
From: Gynvael Coldwind <gynvael@...dwind.pl>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: GDT and LDT in Windows kernel vulnerability exploitation (paper)

Hi,

We've published a paper about using 1 or 4 byte write-what-where
condition to convert a custom Data-Segment Descriptor entry in LDT of
a process into a Call-Gate (with DPL set to 3 and RPL to 0).
The paper also contains information about a possible LDT redirecting
into user-land memory.

The paper is Windows NT family (starting from Windows 2000 and XP) and
x86 protected mode specific.

The paper DOES NOT contain information about new or old
vulnerabilities. It only proposes a way to convert a potential
write-what-where vulnerability into code execution, in a stable
manner.

http://vexillium.org/dl.php?call_gate_exploitation.pdf

More information is available on our blogs:
http://gynvael.coldwind.pl/?id=274
http://j00ru.vexillium.org/?p=290&lang=en

Comments are welcomed :)

Take care,
-- 
gynvael.coldwind//vx and j00ru//vx

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux - Powered by OpenVZ