| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon Sep 19 17:22:23 2005 From: nicolas.ruff at gmail.com (Nicolas RUFF) Subject: LSADump2 Crashing Windows More on LSADUMP2 / XP SP2 incompatibility ... The root of the problem lies inside LSASRV.DLL. You already know that the LSASS process has been plagued by many memory leaks over the years : http://support.microsoft.com/search/default.aspx?qu=lsass+leak With XP SP2, Microsoft added many memory management checks, and the LsarQuerySecret() function called by LSADUMP2 has changed. There is an additional check on the pLsaData parameter ; if pLsaData != NULL or pLsaData.Buffer != NULL, LocalFree() is called before reallocating the buffer (see code below). After the LsaFreeMemory() call in LSADUMP2, pLsaData memory is de-allocated but pLsaData is not set to NULL, so calling LsarQuerySecret() a second time will trigger a "double free"-like error. Fix : Add "lsaData = NULL;" After "LsaFreeMemory (lsaData);" Regards, - Nicolas RUFF Security researcher @ EADS-CCR XP SP1 ------ .text:74544733 mov [ebp+var_C], ebx .text:74544736 mov [ebp+var_10], ebx .text:74544739 mov [ebp+var_8], ebx .text:7454473C mov [ebp+var_2], bl .text:7454473F mov byte ptr [ebp+var_1], bl .text:74544742 call _LsapTraceEvent@8 ; LsapTraceEvent(x,x) .text:74544747 cmp [esi+47h], bl .text:7454474A jnz loc_74556A1E .text:74544750 .text:74544750 loc_74544750: .text:74544750 mov al, [esi+45h] .text:74544753 cmp al, bl .text:74544755 jz loc_745412C9 .text:7454475B .text:7454475B loc_7454475B: .text:7454475B cmp al, bl .text:7454475D push edi .text:7454475E mov edi, 3000001h .text:74544763 jz loc_745412B2 .text:74544769 .text:74544769 loc_74544769: .text:74544769 push edi ; AuthnSvc .text:7454476A push 4 ; int .text:7454476C push 4 ; int .text:7454476E push 2 ; AuthnLevel .text:74544770 push [ebp+arg_0] ; int .text:74544773 call _LsapDbReferenceObject@20 XP SP2 ------ .text:756CC465 mov [ebp+var_C], ebx .text:756CC468 mov [ebp+var_10], ebx .text:756CC46B mov [ebp+var_8], ebx .text:756CC46E mov [ebp+var_2], bl .text:756CC471 mov byte ptr [ebp+var_1], bl .text:756CC474 call _LsapTraceEvent@8 ; LsapTraceEvent(x,x) .text:756CC479 cmp [esi+47h], bl .text:756CC47C jnz loc_756E8A6E .text:756CC482 .text:756CC482 loc_756CC482: .text:756CC482 cmp [esi+45h], bl .text:756CC485 jnz short loc_756CC491 .text:756CC487 test byte ptr [esi+58h], 1 .text:756CC48B jnz loc_756E8A81 .text:756CC491 .text:756CC491 loc_756CC491: .text:756CC491 mov eax, [ebp+arg_pLsaData] .text:756CC494 cmp eax, ebx .text:756CC496 jz short pLsaData_or_LsaData_length_is_NULL .text:756CC498 mov eax, [eax] .text:756CC49A cmp eax, ebx .text:756CC49C jnz pLsaData_or_LsaData_length_is_not_NULL .text:756CC4A2 .text:756CC4A2 pLsaData_or_LsaData_length_is_NULL: .text:756CC4A2 push edi .text:756CC4A3 mov edi, [ebp+arg_pOldLsaData] .text:756CC4A6 cmp edi, ebx .text:756CC4A8 jnz pOldLsaData_is_not_NULL .text:756CC4AE .text:756CC4AE pOldLsaData_is_NULL: .text:756CC4AE cmp [esi+45h], bl .text:756CC4B1 jnz short loc_756CC4C9 .text:756CC4B3 lea eax, [ebp+var_8] .text:756CC4B6 push eax .text:756CC4B7 push [ebp+arg_hSecret] .text:756CC4BA call _LsapCrServerGetSessionKey@8 .text:756CC4BF mov esi, eax .text:756CC4C1 cmp esi, ebx .text:756CC4C3 jl loc_756DFA34 .text:756CC4C9 .text:756CC4C9 loc_756CC4C9: .text:756CC4C9 push 3000001h .text:756CC4CE push 4 .text:756CC4D0 push 4 .text:756CC4D2 push 2 .text:756CC4D4 push [ebp+arg_hSecret] .text:756CC4D7 call _LsapDbReferenceObject@20
Powered by blists - more mailing lists