full-disclosure - GDT and LDT in Windows kernel vulnerability exploitation (paper)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <bd3a94bf1001161653m1a51410cu42c3352ac4639dbe@mail.gmail.com>
Date: Sun, 17 Jan 2010 01:53:48 +0100
From: Gynvael Coldwind <gynvael@...dwind.pl>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: GDT and LDT in Windows kernel vulnerability
	exploitation (paper)

Hi,

We've published a paper about using 1 or 4 byte write-what-where
condition to convert a custom Data-Segment Descriptor entry in LDT of
a process into a Call-Gate (with DPL set to 3 and RPL to 0).
The paper also contains information about a possible LDT redirecting
into user-land memory.

The paper is Windows NT family (starting from Windows 2000 and XP) and
x86 protected mode specific.

The paper DOES NOT contain information about new or old
vulnerabilities. It only proposes a way to convert a potential
write-what-where vulnerability into code execution, in a stable
manner.

http://vexillium.org/dl.php?call_gate_exploitation.pdf

More information is available on our blogs:
http://gynvael.coldwind.pl/?id=274
http://j00ru.vexillium.org/?p=290&lang=en

Comments are welcomed :)

Take care,
-- 
gynvael.coldwind//vx and j00ru//vx

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/