New issue
Advanced search Search tips

Issue 602625 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Feb 2018
Cc:
Components:
EstimatedDays: ----
NextAction: 2018-02-28
OS: Windows
Pri: 1
Type: Bug-Security



Sign in to add a comment

Security: untrusted code exec to kernel code exec, applicable from chrome render process as well

Reported by ferdinan...@gmail.com, Apr 12 2016

Issue description

VULNERABILITY DETAILS
tm.sys is extension of ntoskrnl, and ntos provides various syscalls wrapped to that module. this module is responsible for kernel transaction managment, more you can read at : https://msdn.microsoft.com/en-us/library/windows/desktop/bb986748(v=vs.85).aspx

bug resides, in recovery mechanism. As due to RecoverTransactionManager you can double ObDeref ('arbitrary' decrease pointer count by one) on single transaction object (_ktransaction), and that can potentionally leads to UAF on transaction object. 
Altought you have no access to call syscalls on free-ed transaction, you can missue limited access to it trough enlistment object (_kenlitment), and achieve full kernel io, therefore kernel code exec as well.

VERSION
Chrome Version: from render, to gpu proc
Operating System: tested on windows 10 - x64

REPRODUCTION CASE

pwd : abe1bffbe3fac4abdbf11ae50d5790e0

instruction : 
1> now is hardcoded user name - "alice", put content of ./rsrc/ dir (pwn2goog*) to temp folder : C:\Users\alice\AppData\Local\Temp\Low\ 
* for test from chrome will be needed path to chrome download folder ofc ..

2> compile project (gcc, build.bat, boost dependency)

3> run test for system cmd

* at current version is w32k gdi io technique implementation, however we are working to use it with our ntos io tehcnique, therefore fully exploitable directly from render process
 
02d2fa4b933ae2d6383d8f1a5f8f34ff
485 KB View Download
wdbg.ii
3.4 KB Download

Comment 1 by tsepez@chromium.org, Apr 12 2016

Owner: wfh@chromium.org
Status: Assigned (was: Unconfirmed)
Will, sounds like this needs to be reported to our friends up north; in the mean time, is there some mitigation we might add?  Thanks.

Comment 2 by tsepez@chromium.org, Apr 12 2016

Labels: Security_Severity-High M-50 Security_Impact-Head

Comment 3 by wfh@chromium.org, Apr 12 2016

Labels: OS-Windows Pri-1
Status: ExternalDependency (was: Assigned)
I will report this to MS and update this bug with status. Reporter: can you confirm how you wish this to be credited in any MS advisory?
@1 : as it is going directly trough ntos, there is not much to do
@2 : as for credit : Peter Hlavaty (@zer0mem), KeenLab, Tencent
Project Member

Comment 6 by sheriffbot@chromium.org, Apr 13 2016

Labels: -Security_Impact-Head Security_Impact-Beta
Project Member

Comment 7 by sheriffbot@chromium.org, Apr 14 2016

Labels: -Security_Impact-Beta Security_Impact-Stable
Components: Internals>Sandbox

Comment 9 by wfh@chromium.org, Apr 19 2016

Owner: timwillis@chromium.org
Status: Assigned (was: ExternalDependency)
-> timwillis@
Status: ExternalDependency (was: Assigned)
Thanks for reporting these. Can you please report these to MSRC and let us know the reference numbers for the issues? Reporting them to the vendor won't affect the Chrome eligibility for reward.
sure, thanks
Project Member

Comment 12 by sheriffbot@chromium.org, May 26 2016

Labels: -M-50 M-51
Hi guys, just pinging, all issues (tm & clfs) are repro by Microsoft, and waiting for upcoming patches around September. therefore I recommend keep issues 'hidden' until Microsoft guys successfully patch those.

btw I sent ref numbers by mail to Tim some time ago, however again here : 

clfs - untrusted to kernel #GetSymbol


I have opened case 33285 and the case manager, Stephen will be in touch when there is more information. 


 


clfs - untrusted to kernel #ExtendMetadataBlock


I have opened case 33286 and the case manager, Stephen will be in touch when there is more information. 


 


clfs - untrusted to kernel #ReadMetadataBlock


I have opened case 33287 and the case manager, Stephen will be in touch when there is more information. 


 


clfs - untrusted to kernel #GetUsn


I have opened case 33288 and the case manager, Stephen will be in touch when there is more information. 


 


clfs - kernel to untrusted


I have opened case 33289 and the case manager, Stephen will be in touch when there is more information.


 


clfs - kernel to untrusted #LoadContainerQ


I have opened case 33290 and the case manager, Stephen will be in touch when there is more information. 


 


tm - kernel code exec


I have opened case 33294 and the case manager, Stephen will be in touch when there is more information. 

Project Member

Comment 14 by sheriffbot@chromium.org, Jul 21 2016

Labels: -M-51 M-52
Project Member

Comment 15 by sheriffbot@chromium.org, Sep 1 2016

Labels: -M-52 M-53
Project Member

Comment 16 by sheriffbot@chromium.org, Oct 13 2016

Labels: -M-53 M-54
Labels: reward-topanel
Project Member

Comment 19 by sheriffbot@chromium.org, Dec 2 2016

Labels: -M-54 M-55
Labels: -reward-topanel reward-ineligible
Project Member

Comment 21 by sheriffbot@chromium.org, Jan 26 2017

Labels: -M-55 M-56
Project Member

Comment 22 by sheriffbot@chromium.org, Mar 10 2017

Labels: -M-56 M-57
Project Member

Comment 23 by sheriffbot@chromium.org, Apr 20 2017

Labels: -M-57 M-58
Project Member

Comment 24 by sheriffbot@chromium.org, Jun 6 2017

Labels: -M-58 M-59
Project Member

Comment 25 by sheriffbot@chromium.org, Jul 26 2017

Labels: -M-59 M-60
Project Member

Comment 26 by sheriffbot@chromium.org, Sep 6 2017

Labels: -M-60 M-61
Project Member

Comment 27 by sheriffbot@chromium.org, Oct 18 2017

Labels: -M-61 M-62
Owner: awhalley@chromium.org
Project Member

Comment 29 by sheriffbot@chromium.org, Dec 7 2017

Labels: -M-62 M-63
Project Member

Comment 30 by sheriffbot@chromium.org, Jan 25 2018

Labels: -M-63 M-64

Comment 31 by wfh@chromium.org, Feb 14 2018

Labels: Needs-Feedback
NextAction: 2018-02-28
Owner: wfh@chromium.org
Were this bugs every reported to MSFT? Do you have an MSRC reference number for each bug. If not, I will go ahead and close these bugs in a week or two.

Comment 32 by wfh@chromium.org, Feb 14 2018

Status: Fixed (was: ExternalDependency)
looks like this one was actually fixed.
Project Member

Comment 33 by sheriffbot@chromium.org, Feb 15 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
The NextAction date has arrived: 2018-02-28
Project Member

Comment 35 by sheriffbot@chromium.org, May 24 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment