{"id":44183,"date":"2015-04-22T07:00:00","date_gmt":"2015-04-22T21:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2015\/04\/22\/it-rather-involved-being-on-the-other-side-of-this-airtight-hatchway-invalid-parameters-from-one-security-level-crashing-code-at-the-same-security-level-yet-again\/"},"modified":"2019-03-13T12:14:56","modified_gmt":"2019-03-13T19:14:56","slug":"20150422-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20150422-00\/?p=44183","title":{"rendered":"It rather involved being on the other side of this airtight hatchway: Invalid parameters from one security level crashing code at the same security level (yet again)"},"content":{"rendered":"

It’s the bogus vulnerability that keeps on giving. This time a security researcher found a horrible security flaw in Sys­Alloc­String­Len<\/code>: <\/p>\n

\n

The Sys­Alloc­String­Len<\/code> function is vulnerable to a denial-of-service attack. [Long description of reverse-engineering deleted.] <\/p>\n

The Sys­Alloc­String­Len<\/code> does not check the length parameter properly. If the provided length is larger than the actual length of the buffer, it may encounter an access violation when reading beyond the end of the buffer. Proof of concept: <\/p>\n

\nSysAllocStringLen(L\"Example\", 0xFFFFFF);\n<\/pre>\n
Credit for this vulnerability should be given to XYZ Security Labs. Copyright © XYZ Security Labs. All rights reserved. <\/p>\n<\/blockquote>\n
As with other issues of this type, there is no elevation. The attack code and the code that crashes are on the same side of the airtight hatchway. If your goal was to make the process crash, then instead of passing invalid parameters to the Sys­Alloc­String­Len<\/code> function, you can launch the denial of service attack much more easily: <\/p>\n
\nint __cdecl main(int, char**)\n{\n    ExitProcess(0);\n}\n<\/pre>\n
Congratulations, you just launched a denial-of-service attack against yourself. <\/p>\n
In order to trigger an access violation in the Sys­Alloc­String­Len<\/code> function, you must already have had enough privilege to run code, which means that you already have enough privilege to terminate the application without needing the Sys­Alloc­String­Len<\/code> function. <\/p>\n
Once again, we have a case of MS07-052: Code execution results in code execution<\/a>.¹ <\/p>\n
Earlier in the series<\/b>: <\/p>\n