New issue
Advanced search Search tips
Starred by 1 user

Issue metadata

Status: Fixed
Closed: Oct 2016

Sign in to add a comment

Issue 918: NVIDIA: (NvStreamKms) Stack buffer overflow in PsSetCreateProcessNotifyRoutineEx callback

Reported by, Aug 27 2016

Issue description

The NvStreamKms.sys driver calls PsSetCreateProcessNotifyRoutineEx to set up a
process creation notification routine.

In this particular routine,

if ( cur->image_names_count > 0 ) {
  // info_ is the PPS_CREATE_NOTIFY_INFO that is passed to the routine.
  image_filename = info_->ImageFileName;
  buf = image_filename->Buffer;
  if ( buf )
    if ( !v5 )
      i = 0i64;
      num_chars = image_filename->Length / 2;
      // Look for the filename by scanning for backslash.
      if ( num_chars )
        while ( buf[num_chars - (unsigned int)i - 1] != '\\' )
          i = (unsigned int)(i + 1);
          if ( (unsigned int)i >= num_chars )
            goto LABEL_39;
        buf += num_chars - (unsigned __int64)(unsigned int)i;
      v26 = (unsigned int)i;
      wcscpy_s((wchar_t *)Dst, i, buf);
      Dst[v26] = 0;
      wcslwr((wchar_t *)Dst);
      v5 = 1;

wcscpy_s is used incorrectly here, as the second argument is not the size of
|Dst|, but rather the calculated size of the filename. |Dst| is a stack buffer
that is at least 255 characters long. The the maximum component paths of most
filesystems on Windows have a limit that is <= 255 though, so this shouldn't be
an issue on normal filesystems.

However, one can pass UNC paths to CreateProcessW containing forward slashes as
the path delimiter, which means that the extracted filename here can be
"a/b/c/...", leading to a buffer overflow. Additionally, this function has no
stack cookie.


CreateProcessW(L"\\\\?\\UNC\\\\DavWWWRoot\\..../..../..../blah.exe", ...

Crashing context with my PoC (Win 10 x64 with 372.54):

fffff801`5c791c6a c3              ret

kd> dqs rsp
ffffd000`25bc5d18  00410041`00410041

kd> t


fffff800`5b1d1c6a c3              ret

To reproduce, a WebDAV server is required (can be localhost), and the WebClient
service needs to be started (start can be triggered by user without additional privileges).

Then, run setup to create the long path to the target executable (you'll need to
change the base directories), and then run poc_part1, and then poc_part2 (with
the right UNC path) on the target machine.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
1.5 KB Download

Comment 1 by, Aug 27 2016

(thanks to forshaw@ for pointing me to WebDAV :) )

Comment 2 by, Aug 27 2016

Summary: NVIDIA: (NvStreamKms) Stack buffer overflow in PsSetCreateProcessNotifyRoutineEx callback (was: NvStreamKms: Stack buffer overflow in PsSetCreateProcessNotifyRoutineEx callback)

Comment 3 by, Oct 7 2016

proof of concept local privesc exploit.
116 KB Download

Comment 4 by, Oct 28 2016

Labels: CVE-2016-8812

Comment 5 by, Oct 28 2016

Labels: -Restrict-View-Commit
Status: Fixed (was: New)
Fixed. Bulletin:

Sign in to add a comment