{"id":12093,"date":"2010-12-08T07:00:00","date_gmt":"2010-12-08T07:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2010\/12\/08\/it-rather-involved-being-on-the-other-side-of-this-airtight-hatchway-invalid-parameters-from-one-security-level-crashing-code-at-the-same-security-level\/"},"modified":"2010-12-08T07:00:00","modified_gmt":"2010-12-08T07:00:00","slug":"it-rather-involved-being-on-the-other-side-of-this-airtight-hatchway-invalid-parameters-from-one-security-level-crashing-code-at-the-same-security-level","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20101208-00\/?p=12093","title":{"rendered":"It rather involved being on the other side of this airtight hatchway: Invalid parameters from one security level crashing code at the same security level"},"content":{"rendered":"

\nIn the category of dubious security vulnerability,\nI submit the following (paraphrased) report:\n<\/p>\n

\nI have discovered that if you call the XYZ<\/code> function\n(whose first parameter is supposed to be a pointer to a\nIUnknown<\/i>),\nand instead of passing a valid COM object pointer,\nyou pass a pointer to a random hunk of data,\nyou can trigger an access violation in the\nXYZ<\/code> function which is exploitable\nby putting specially-crafted data in that memory blob.\nAn attacker can exploit the XYZ<\/code> function for remote\nexecution and compromise the system,\nprovided an application uses the XYZ<\/code> function and passes\na pointer to untrusted data as the first parameter\ninstead of a valid IUnknown<\/code> pointer.\nAlthough we have not found an application which uses the XYZ<\/code>\nin this way,\nthe function neverless contains the potential for exploit,\nand the bug should be fixed as soon as possible.\n<\/p><\/blockquote>\n

The person included a sample program which went something\nlike this (except more complicated):<\/p>\n

\n\/\/ We can control the behavior by tweaking the value\n\/\/ of the Exploit array.\nunsigned char Exploit[] = \"\\x01\\x02\\x03...\";\nvoid main()\n{\n   XYZ((IUnknown*)Exploit);\n}\n<\/pre>\n
\nWell, yeah, but you’re already on the other side of the\nairtight hatchway.\nInstead of building up a complicated blob of memory\nwith exactly the right format, just write your bad\nIUnknown<\/code>:\n<\/p>\n
\nvoid Pwnz0r()\n{\n  ... whatever you want ...\n}\nclass Exploit : public IUnknown\n{\npublic:\n  STDMETHODIMP QueryInterface(REFIID riid, void **ppv)\n  { Pwnz0r(); return E_NOINTERFACE; }\n  STDMETHODIMP_(ULONG) AddRef() { Pwnz0r(); return 2; }\n  STDMETHODIMP_(ULONG) Release() { Pwnz0r(); return 1; }\n};\nvoid main()\n{\n   XYZ(&Exploit);\n}\n<\/pre>\n
\nWow, this new “exploit” is even portable to other\narchitectures!\n<\/p>\n
\nActually, now that you’re on the other side of the airtight\nhatchway, you may as well take XYZ<\/code> out of the picture\nsince it’s just slowing you down:\n<\/p>\n
\nvoid main()\n{\n   Pwnz0r();\n}\n<\/pre>\n
\nYou’re already running code.\n\nIt’s not surprising that you can run code<\/a>.\n<\/p>\n
\nThere’s nothing subtle going on here.\nThere is no elevation of privilege because the rogue activity happens\nin user-mode code, based on rogue code provided by an executable\nwith trusted code execution privileges,\nat the same security level as the original executable.\n<\/p>\n
\nThe people reporting the alleged vulnerability do say that\nthey haven’t yet found any program that calls the XYZ<\/code>\nfunction with untrusted data,\nbut even if they did,\nthat would be a data handling bug in the application itself:\nData crossed a trust boundary without proper validation.\nIt’s like saying “There is a security vulnerability in the\nDeleteFile<\/code> function because it is possible for\nan application to pass an untrusted file name and thereby result\nin an attacker deleting any file of his choosing.”\nEven if such a vulnerability existed, the flaw is in the\napplication for not validating its input, not in\nDeleteFile<\/code> for, um, deleting the file it was told to delete.\n<\/p>\n
\nThe sad thing is that it took the security team five days to\nresolve this issue,\nbecause even though it looks like a slam dunk,\nthe issue resolution process must be followed, just to be sure.\nWho knows,\nmaybe there really is a bug in the XYZ<\/code> function’s\nuse of the first parameter that would result in elevation\nof privilege.\nAll supported versions of Windows need to be examined for the\nslim possibility that there’s something behind this confused\nvulnerability report.\n<\/p>\n
\nBut there isn’t.\nIt’s just another dubious security vulnerability report.\n<\/p>\n
\nExercise<\/b>:\nApply what you learned to this security vulnerability report.\nThis is also paraphrased from an actual security report:\n<\/p>\n
\n
\nThere is a serious denial-of-service vulnerability in the\nfunction XYZ<\/code>.\nThis function takes a pointer to a buffer and a length.\nIf the function is passed malformed parameters,\nit may encounter an access violation when it tries to read\nfrom an invalid buffer.\nAny application which calls this function with bad parameters\nwill crash.\nHere is a sample program that illustrates the vulnerability:\n<\/p>\n
\nint main(int argc, char **argv)\n{\n \/\/ crash inside XYZ attempting to read past end of buffer\n XYZ(\"x\", 9999999);\n return 0;\n}\n<\/pre>\n
\nCredit for discovering this vulnerability\ngoes to ABC Security Research Company.\nCopyright© 20xx ABC Security Research Company.\nAll Rights Reserved.\n<\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"
In the category of dubious security vulnerability, I submit the following (paraphrased) report: I have discovered that if you call the XYZ function (whose first parameter is supposed to be a pointer to a IUnknown), and instead of passing a valid COM object pointer, you pass a pointer to a random hunk of data, you […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-12093","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"
In the category of dubious security vulnerability, I submit the following (paraphrased) report: I have discovered that if you call the XYZ function (whose first parameter is supposed to be a pointer to a IUnknown), and instead of passing a valid COM object pointer, you pass a pointer to a random hunk of data, you […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/12093","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=12093"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/12093\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=12093"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=12093"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=12093"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}