Search...

NVIDIA Driver - Stack Buffer Overflow in Escape 0x10000e9

2016-10-31T00:00:00

ID EXPLOITPACK:8550605532FB180AE16532D443985038
Type exploitpack
Reporter Google Security Research
Modified 2016-10-31T00:00:00

Description

NVIDIA Driver - Stack Buffer Overflow in Escape 0x10000e9

                                        
                                            Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=947

The escape handler for 0x10000e9 lacks bounds checks, and passes a user
specified size as the size to memcpy, resulting in a stack buffer overflow:

bool escape_10000e9(NvMiniportDeviceContext *a1, Escape10000e9 *escape) {
  ...
  LOBYTE(a9) = escape_-&gt;unknown_5[1] != 0;
  LOBYTE(a8) = escape_-&gt;unknown_5[0] != 0;
  if ( !sub_DC57C(
          *(_QWORD *)(*(_QWORD *)(v4 + 104) + 1000i64),
          escape_-&gt;unknown_1,
          escape_-&gt;unknown_2,
          escape_-&gt;unknown_3,
          escape_-&gt;unknown_4,
          escape_-&gt;data,
          escape_-&gt;size,
          a8,
          a9,
          &escape_-&gt;unknown_5[2]) )
    return 0;
  escape_-&gt;header.result = 1;
  return 1;
}

char sub_DC57C(...) {
  ...
  // escape_buf is escape_-&gt;data from previous function
  // buf_size is escape-&gt;size
  memcpy(&stack_buf, escape_buf, (unsigned int)buf_size);
  ...

Crashing context (Win 10 x64, 372.54):

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
...

STACK_TEXT:  
ffffd000`263bc188 fffff803`9d1deaf2 : 9d919d43`2d3cc8a7 00000000`000000f7 ffffd000`263bc2f0 fffff803`9d03c848 : nt!DbgBreakPointWithStatus
ffffd000`263bc190 fffff803`9d1de4c3 : 00000000`00000003 ffffd000`263bc2f0 fffff803`9d16c600 00000000`000000f7 : nt!KiBugCheckDebugBreak+0x12
ffffd000`263bc1f0 fffff803`9d15fa44 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffc000`494d4764 : nt!KeBugCheck2+0x893
ffffd000`263bc900 fffff800`ad8c2bc6 : 00000000`000000f7 9d919d43`2d3cc8a7 0000f6ec`74dc94fc ffff0913`8b236b03 : nt!KeBugCheckEx+0x104
ffffd000`263bc940 fffff800`ad7fc6f7 : c0004492`55400400 ffff8000`00000000 ffffc000`44925540 00000000`00000000 : nvlddmkm+0x192bc6
ffffd000`263bc980 ffffc000`585e78a0 : 00000000`000005d4 00430043`00310030 4666744e`03610107 00000000`00000000 : nvlddmkm+0xcc6f7
ffffd000`263bce70 00000000`000005d4 : 00430043`00310030 4666744e`03610107 00000000`00000000 00000c48`01380702 : 0xffffc000`585e78a0
ffffd000`263bce78 00430043`00310030 : 4666744e`03610107 00000000`00000000 00000c48`01380702 00010000`000166c2 : 0x5d4
ffffd000`263bce80 4666744e`03610107 : 00000000`00000000 00000c48`01380702 00010000`000166c2 00000000`00000000 : 0x00430043`00310030
ffffd000`263bce88 00000000`00000000 : 00000c48`01380702 00010000`000166c2 00000000`00000000 00000000`00000000 : 0x4666744e`03610107


Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40668.zip

JSON Vulners Source

Initial Source

{"lastseen": "2020-04-01T19:04:36", "references": [], "description": "\nNVIDIA Driver - Stack Buffer Overflow in Escape 0x10000e9", "edition": 1, "reporter": "Google Security Research", "exploitpack": {"type": "dos", "platform": "windows"}, "published": "2016-10-31T00:00:00", "title": "NVIDIA Driver - Stack Buffer Overflow in Escape 0x10000e9", "type": "exploitpack", "enchantments": {"dependencies": {"references": [], "modified": "2020-04-01T19:04:36", "rev": 2}, "score": {"value": 1.3, "vector": "NONE", "modified": "2020-04-01T19:04:36", "rev": 2}, "vulnersScore": 1.3}, "bulletinFamily": "exploit", "cvelist": [], "modified": "2016-10-31T00:00:00", "id": "EXPLOITPACK:8550605532FB180AE16532D443985038", "href": "", "viewCount": 1, "sourceData": "Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=947\n\nThe escape handler for 0x10000e9 lacks bounds checks, and passes a user\nspecified size as the size to memcpy, resulting in a stack buffer overflow:\n\nbool escape_10000e9(NvMiniportDeviceContext *a1, Escape10000e9 *escape) {\n ...\n LOBYTE(a9) = escape_->unknown_5[1] != 0;\n LOBYTE(a8) = escape_->unknown_5[0] != 0;\n if ( !sub_DC57C(\n *(_QWORD *)(*(_QWORD *)(v4 + 104) + 1000i64),\n escape_->unknown_1,\n escape_->unknown_2,\n escape_->unknown_3,\n escape_->unknown_4,\n escape_->data,\n escape_->size,\n a8,\n a9,\n &escape_->unknown_5[2]) )\n return 0;\n escape_->header.result = 1;\n return 1;\n}\n\nchar sub_DC57C(...) {\n ...\n // escape_buf is escape_->data from previous function\n // buf_size is escape->size\n memcpy(&stack_buf, escape_buf, (unsigned int)buf_size);\n ...\n\nCrashing context (Win 10 x64, 372.54):\n\nDRIVER_OVERRAN_STACK_BUFFER (f7)\nA driver has overrun a stack-based buffer. This overrun could potentially\nallow a malicious user to gain control of this machine.\n...\n\nSTACK_TEXT: \nffffd000`263bc188 fffff803`9d1deaf2 : 9d919d43`2d3cc8a7 00000000`000000f7 ffffd000`263bc2f0 fffff803`9d03c848 : nt!DbgBreakPointWithStatus\nffffd000`263bc190 fffff803`9d1de4c3 : 00000000`00000003 ffffd000`263bc2f0 fffff803`9d16c600 00000000`000000f7 : nt!KiBugCheckDebugBreak+0x12\nffffd000`263bc1f0 fffff803`9d15fa44 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffc000`494d4764 : nt!KeBugCheck2+0x893\nffffd000`263bc900 fffff800`ad8c2bc6 : 00000000`000000f7 9d919d43`2d3cc8a7 0000f6ec`74dc94fc ffff0913`8b236b03 : nt!KeBugCheckEx+0x104\nffffd000`263bc940 fffff800`ad7fc6f7 : c0004492`55400400 ffff8000`00000000 ffffc000`44925540 00000000`00000000 : nvlddmkm+0x192bc6\nffffd000`263bc980 ffffc000`585e78a0 : 00000000`000005d4 00430043`00310030 4666744e`03610107 00000000`00000000 : nvlddmkm+0xcc6f7\nffffd000`263bce70 00000000`000005d4 : 00430043`00310030 4666744e`03610107 00000000`00000000 00000c48`01380702 : 0xffffc000`585e78a0\nffffd000`263bce78 00430043`00310030 : 4666744e`03610107 00000000`00000000 00000c48`01380702 00010000`000166c2 : 0x5d4\nffffd000`263bce80 4666744e`03610107 : 00000000`00000000 00000c48`01380702 00010000`000166c2 00000000`00000000 : 0x00430043`00310030\nffffd000`263bce88 00000000`00000000 : 00000c48`01380702 00010000`000166c2 00000000`00000000 00000000`00000000 : 0x4666744e`03610107\n\n\nProof of Concept:\nhttps://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/40668.zip", "cvss": {"score": 0.0, "vector": "NONE"}}