Message-ID: <4FA98CFB.60102@coresecurity.com>
Date: Tue, 08 May 2012 18:15:39 -0300
From: "Core Security Advisories Team (fr)"
	<advisories-publication@...esecurity.com>
To: full-disclosure@...ts.grok.org.uk
Subject: CORE-2011-1123: Windows Kernel ReadLayoutFile
	Heap Overflow


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

Windows Kernel ReadLayoutFile Heap Overflow

1. *Advisory Information*
   
Title: Windows Kernel ReadLayoutFile Heap Overflow
Advisory ID: CORE-2011-1123
Advisory URL:
http://www.coresecurity.com/content/windows-kernel-readlayoutfile
Date published: 2012-05-08
Date of last update: 2011-05-08
Vendors contacted: Microsoft
Release mode: Coordinated release


2. *Vulnerability Information*
   
Class: Heap-based Buffer Overflow [CWE-122]
Impact: Code execution
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2012-0181


3. *Vulnerability Description*
   
There is a bug in the ReadLayoutFile Windows Kernel function that can be
leveraged into a local privilege escalation exploit, potentially usable
in a client-side attack scenario or after a remote intrusion by other means.
   
This bug is similar to another bug used by a client-side exploit in Stuxnet.
   

4. *Vulnerable packages*
       
   . Windows XP SP3.      
   . Windows Vista SP2.       
   . Windows 7 SP1.       
   . Windows Server 2003 SP2.       
   . Windows Server 2008 SP2.       
   . Other Windows versions might be vulnerable but were not tested.


5. *Vendor Information, Solutions and Workarounds*
   
Apply security patch MS12-034 [3].


6. *Credits*
   
This vulnerability was discovered and researched by Nicolás Economou
from Core Security Technologies. The publication of this advisory was
coordinated by Fernando Russ.


7. *Technical Description / Proof of Concept Code*
 
     
There is a bug in the 'ReadLayoutFile' Windows Kernel ('win32k.sys')
function that can be leveraged into a local privilege escalation
exploit, potentially usable in a client-side attack scenario, or after a
remote intrusion by other means.
         
Custom keyboard layouts are implemented using a .dll file exporting the
'KbdLayerDescriptor' function which, in theory, returns a pointer to a
structure of type 'KBDTABLES' that is stored in the '.DATA' sections of
the PE file. The 'NtUserLoadKeyboardLayoutEx' is a private function used
by 'LoadKeyboardLayout'  [2] to load a custom keyboard layout, as
arguments 'NtUserLoadKeyboardLayoutEx' uses an open file handle pointing
to a keyboard layout library. When the function
'NtUserLoadKeyboardLayoutEx' is correctly called the PE file referenced
by its arguments is mapped in kernel space.

The bug is due to a memory corruption: a double word can be overwritten
in a position relative to the base of the allocated memory in kernel
space. We have to distinguish two different scenarios for exploiting
this vulnerability:
       
For Windows XP,
   . There is no check for the path from where the keyboard layout will
be loaded. (So, we can craft a file and use it as keyboard layout
without having write permission on \Windows\System32)          
   . There is no bound check for the value used to index the '.DATA'
section of the keyboard layout .dll where the actual where the actual
layout descriptor table is stored. (So, we can reference spurious memory
address)      

For other vulnerable Windows Versions,
   . The file handle used to load the keyboard layout must refer to a
file located in \Windows\System32.          
   . The value used to index the '.DATA' section of the keyboard layout
is incorrectly bound checked.             
   
We can confirm reliable exploitation for the following Microsoft Windows
versions:
        
   . Windows XP SP3       
   . Windows Server 2003 SP2       
   . Windows Server 2008 SP2

     
8. *Report Timeline*

    
. 2011-11-23:
Core Security Technologies notifies MSRC of the vulnerability, including
technical details and a PoC that crashes Windows XP SP3.

. 2011-11-23:
Vendor acknowledges the receipt of the information. Vendor warns Core
Security Technologies that it may take longer than normal for a
technical review of the bug because of the Thanksgiving holiday.

. 2011-11-24:
Core acknowledges the aforementioned possible delay and wishes MSRC a
happy Thanksgiving.

. 2011-11-25:
MSRC opens case number "MSRC 12000gd" for report tracking.

. 2011-11-28:
MSRC mentions over an unencrypted communication channel that they are
currently investigating the issue, and that they'll let Core Security
Technologies know of their findings when the investigation is complete.

. 2011-11-29:
Core Security Technologies acknowledges the previous e-mail.

. 2011-12-08:
MSRC contacts Core Security Technologies for a quick update, informing
that they were able to reproduce the crash and that it is indeed very
similar to bug publicly exploited at [1]. MSRC informs that they are
currently discussing the next steps they will take with Windows Product
Team.

. 2012-01-09:
Ivan Arce, current CTO and founder of the Core Advisories Team, leaves
Core after 15 years. Thanks Wari!

. 2012-01-17:
MSRC notifies that the release of a fix was scheduled for March 2012.

. 2012-01-18:
Core acknowledges the previous update and notifies that Nicolas Economou
has further analyzed the crash (publicly available in exploit-db) and
concluded it is indeed a different issue. Core offers to compile
Nicolas' findings into a private technical report.

. 2012-01-18:
MSRC validates Nicolas' findings stating the two issues are separate,
even though they share a same code area.

. 2012-03-09:
Core asks if the March publication date still stands.

. 2012-03-12:
MSRC notifies that, due to some late findings about app-compat concerns,
they will need more time to issue the patch. MSRC asks to re-schedule
the advisory publication to May 8th.

. 2012-03-09:
Core re-schedules the advisory publication to May 8th.

. 2012-04-01:
Pedro Varangot leaves the Core Advisories Team. Thanks Peter and good
luck with your new challenges.

. 2012-04-02:
Core asks for additional information regarding the actual vulnerable
Windows' versions and specific workarounds for this vulnerability.

. 2012-04-03:
MSRC notifies that the actual vulnerable systems are Windows XP/2003 as
Elevation of Privileges and Windows Vista/2008 as Denial of Service.
MSRC also notifies that no workaround has been identified for this
vulnerability.

. 2012-05-08:
The advisory CORE-2011-1123 is published.
 

9. *References*
   
[1]  http://www.exploit-db.com/exploits/18140/  
[2] 
http://msdn.microsoft.com/en-us/library/windows/desktop/ms646305(v=vs.85).aspx
 
[3]  http://technet.microsoft.com/en-gb/security/bulletin/ms12-034  

10. *About CoreLabs*

CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://corelabs.coresecurity.com.


11. *About Core Security Technologies*

    
Core Security Technologies enables organizations to get ahead of threats
with security test and measurement solutions that continuously identify
and demonstrate real-world exposures to their most critical assets. Our
customers can gain real visibility into their security standing, real
validation of their security controls, and real metrics to more
effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted
research and leading-edge threat expertise from the company's Security
Consulting Services, CoreLabs and Engineering groups. Core Security
Technologies can be reached at +1 (617) 399-6980 or on the Web at:
http://www.coresecurity.com.


12. *Disclaimer*

The contents of this advisory are copyright (c) 2012 Core Security
Technologies and (c) 2012 CoreLabs, and are licensed under a Creative
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/  
 

13. *PGP/GPG Keys*
   
This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPqYz1AAoJEK6bq3WCdh+H4ngH/3dvFpisLseX7byRf9o8l+OA
g+IErburOFD3lLBD4/zPTfzs4KyU/LhIBGJivVN1IX8eAeW95IikTicUXM4zz79c
e4O6k2NwbWUUHABlP2GhLgMPangdHjsPRS8vwhhAEaTjcqFq4THeugDc433Xxvzo
6i2Wqj/iee66vF92sV//Oo7HPJEzAHcdNXiQprHIksQF5/ogj34Cu/A9R2b+Ryza
bDv+0DGzetYVhR74Do9NSarYBN/BFn1CGPSTd7MkB7ufNPB0nxoq+5G9u7zGcECR
TspAonEljSOAjLaCIId3xkPrCnrNiyJ1HJ5ujpqrYqVXp/OpYC0XL6KLXiB2Gs0=
=Kt0l
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists