full-disclosure - Compuware Softice (DbgMsg driver) Local Denial Of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4299AA3A.4020607@gmail.com>
Date: Sun May 29 12:51:02 2005
From: bania.piotr at gmail.com (Piotr Bania)
Subject: Compuware Softice (DbgMsg driver) Local Denial Of
	Service

Compuware Softice (DbgMsg driver) Local Denial Of Service
by Piotr Bania <bania.piotr@...il.com>
http://pb.specialised.info

Original location: 	http://pb.specialised.info/all/adv/sice-adv.txt

Severity: 		Low / Medium  - BSOD (Blue Screen Of Death) DOS

Software affected:	Tested on Softice from DriverStudio 3.2 and 3.1.
			However all version with DbgMsg.sys driver
			installed should be marked as vulnerable.

I.  BACKGROUND

SoftICE is a powerful system-wide debugger that supports source level
debugging of any software, driver, service, and most bios code on either 
a single or dual machine configuration.

II. DESCRIPTION	

On NT based operating systems Debug Messages are being sent by executing
the OutputDebugString API (ring3 applications) or by executing 
DbgPrint() function (also known as KdPrint(), mostly used by ring0 
"applications").

However not only kernel mode stuff can execute DbgPrint() since it is 
exported by NTDLL.DLL - so called native calls. If we go forward we will 
see that actually the final pass of the Debug Message is done by 
executing INT 2Dh, like following example shows:

----// SNIP SNIP //-------------------------------------------------

mov ecx,offset some_string	; Debug Message offset
xor edx,edx			; second Param (NULL in this case)
mov eax,1			; Service Type here defined as
				; BREAKPOINT_PRINT (=1)

int 2dh
int 3
nop			   <--- int 2dh returns here not to int 3

----// SNIP SNIP //-------------------------------------------------

When Softice is installed - DbgMsg.sys driver is loaded (user should 
also notice that even when Softice is not active, the system is still 
vulnerable), executed 2d interrupt will be firstly filtered by 
DbgMsg.sys routine. This is probably provided to capture are flying 
Debug Messages and display them into the debugger window.

However the driver doesn't validate the Debug Message pointer properly, 
this can cause an machine crash when the pointer is invalid.

III. IMPACT

Executing special crafted "int 2dh" request will cause local machine 
crash on system with DbgMsg.sys driver installed, *even* when Softice is 
not active. This attack can be also used as a very nasty anti-debugging 
trick against Softice users.

IV. POC CODE

Sample POC code was developed.

best regards,
Piotr Bania

-- 
--------------------------------------------------------------------
Piotr Bania - <bania.piotr@...il.com> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A  BFA4 1FF6 689F BE43 AC33
http://pb.specialised.info  - Key ID: 0xBE43AC33
--------------------------------------------------------------------