Monorail Project: project-zero Issues People Development process History Sign in
New issue
Advanced search Search tips
Starred by 2 users
Status: Fixed
Owner:
Closed: Oct 2015
Cc:



Sign in to add a comment
Truecrypt 7 Derived Code/Windows: Incorrect Impersonation Token Handling EoP
Project Member Reported by forshaw@google.com, Sep 18 2015 Back to list
Truecrypt 7 Derived Code/Windows: Incorrect Impersonation Token Handling EoP
Platform: Windows
Class: Local Elevation of Privilege

Summary:
The Windows driver used by projects derived from Truecrypt 7 (verified in Veracrypt and CipherShed) are vulnerable to a local elevation of privilege attack by checking process of impersonation token which allow a user to inspect and potentially manipulate other users mounted encrypted volumes on the same machine.

Description:

The methods IsVolumeAccessibleByCurrentUser and MountDevice in Ntdriver.c use the SeCaptureSubjectContext to get the current user security context for the caller. They then use the SeQuerySubjectContextToken macro to extract the current active token, either the primary or impersonation token. In the impersonation token case no checks are made on the current impersonation level, this means one user could impersonate a user at SecurityIdentify level and pretend to be another leading to a security bypass. I think the only thing this gives an attacker would be to unmount other users volumes or inspect their configuration.

Note I don’t believe this is really a serious issue as if you’re mounting encrypted volumes on shared machine and leaving them mounted I think you’ve got other problems. Still I believe it’s an easy change to fix it if anything for consistency. Also this wasn’t reported in the iSec Partners security review so it’s not an missed fix.

Fixing the Issue:
My personal recommendation would be to only ever use the primary token when determining the user information. Either by referencing SECURITY_SUBJECT_CONTEXT::PrimaryToken or calling PsReferencePrimaryToken. Of course if impersonation must be supported then when using an impersonation token verify that subContext->ImpersonationLevel is greater or equal to SecurityImpersonation and either fall back to the primary token or return STATUS_ACCESS_DENIED. For example:

SeCaptureSubjectContext (&subContext);
if (subContext.ClientToken && subContext.ImpersonationLevel >= SecurityImpersonation)
  accessToken = subContext->ClientToken;
else
  accessToken = subContext->PrimaryToken;

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.


 
Project Member Comment 1 by forshaw@google.com, Sep 26 2015
Labels: CVE-2015-7359
Fixed in Veracrypt 1.15, see https://veracrypt.codeplex.com/wikipage?title=Release%20Notes
Project Member Comment 2 by forshaw@google.com, Oct 3 2015
Labels: -Restrict-View-Commit
Status: Fixed
Remove view restrictions
In the future it would be nice to contact us (security@ciphershed.org). We had to find out from third parties.
Comment 4 by bokujo...@gmail.com, Nov 24 2015
Thank you for the information brother, the code or program for what brother?

https://www.bestautocars.xyz/
Comment 5 Deleted
Sign in to add a comment