Windows Kernel 64-bit stack memory disclosure in msrpc!LRPC_CASSOCIATION::AlpcSendCancelMessage(CVE-2018-0896)

We have discovered that the msrpc!LRPCCASSOCIATION::AlpcSendCancelMessage function sends an ALPC message with portions of uninitialized memory from the local stack frame on Windows 7 64-bit other versions were not tested. The message is 0x18 bytes long, 8 of which are uninitialized. The layout of...

LRPC buffer overflow-vulnerability warning-the black bar safety net

The LPC client by NtConnectPort connected to the server, the server returns a message maximum length, however RPCRT4! LRPCCASSOCIATION::OpenLpcPort call NtConnectPort and not using this return value, but the use of NULL parameters. rpcrt4! LRPCCASSOCIATION::ActuallyDoBinding and so many calls to...