NVIDIA Driver – Stack Buffer Overflow in Escape 0x7000014

• Exploit Database
• 14 阅读

• 作者： Google Security Research
  日期： 2016-10-31
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40667/

• Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=946
  
  There is a missing bounds check in inner loop of the escape handler for 0x7000014
  that leads to a stack buffer overflow:
  
  ...
  for (DWORD i = 0; < escape->num_data; ++i) {
  ...
  // size is user controlled.
  size = escape->data[i].size;
  for (DWORD j = 0; j < size; ++j) {
   stack_buf[j] = escape->data[...];
  } 
  }
  
  The attached PoC gives me the following crashing context (Win 10 x64, 372.54):
  
  DRIVER_OVERRAN_STACK_BUFFER (f7)
  A driver has overrun a stack-based buffer.This overrun could potentially
  allow a malicious user to gain control of this machine.
  ...
  ffffd000`23f94a78 fffff801`6e5deaf2 : ffffd000`23f95270 00000000`000000f7 ffffd000`23f94be0 fffff801`6e43c848 : nt!DbgBreakPointWithStatus
  ffffd000`23f94a80 fffff801`6e5de4c3 : 00000000`00000003 ffffd000`23f94be0 fffff801`6e56c600 00000000`000000f7 : nt!KiBugCheckDebugBreak+0x12
  ffffd000`23f94ae0 fffff801`6e55fa44 : 00000000`00000000 00000000`00000000 ffffc001`c8e7202c fffff801`6e7188b8 : nt!KeBugCheck2+0x893
  ffffd000`23f951f0 fffff800`c58e2bc6 : 00000000`000000f7 ffffd000`23f95270 000044dd`b2c37fec ffffbb22`4d3c8013 : nt!KeBugCheckEx+0x104
  ffffd000`23f95230 fffff800`c57ba4ce : ffffd000`23f95220 ffffe000`69a62000 00000000`00000001 00000000`07000014 : nvlddmkm+0x192bc6
  ffffd000`23f95270 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nvlddmkm+0x6a4ce
  
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40667.zip