{"id":8883,"date":"2011-12-15T07:00:00","date_gmt":"2011-12-15T07:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2011\/12\/15\/not-even-making-it-to-the-airtight-hatchway-execution-even-before-you-get-there\/"},"modified":"2011-12-15T07:00:00","modified_gmt":"2011-12-15T07:00:00","slug":"not-even-making-it-to-the-airtight-hatchway-execution-even-before-you-get-there","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20111215-00\/?p=8883\/","title":{"rendered":"Not even making it to the airtight hatchway: Execution even before you get there"},"content":{"rendered":"

\nToday’s dubious security vulnerability comes from somebody who\nreported that the Load­Keyboard­Layout<\/code> function\nhad a security vulnerability which could lead to arbitrary code\nexecution.\nThis is a serious issue, but reading the report made us wonder\nif something was missing.\n<\/p>\n

\n\/\/ sample program to illustrate the vulnerability.\n#include <windows.h>\n#include <stdio.h>\n#include <stdlib.h>\nint __cdecl main(int argc, char **argv)\n{\n LoadKeyboardLayout(\"whatever\", system(\"notepad.exe\"));\n return 0;\n}\n<\/pre>\n
\nAccording to the report, this sample program illustrates that\nthe Load­Keyboard­Layout<\/code> function\nwill execute whatever you pass as its second parameter.\nIn this case, the program chose to launch Notepad,\nbut obviously an attacker could change the code to something\nmore dangerous.\n<\/p>\n
\nWe had trouble trying to figure out what the person was trying to say.\nAfter all, it’s not the\nLoad­Keyboard­Layout<\/code> function\nthat is executing the second parameter.\nIt’s the sample program that’s doing it,\nand using the return value as the second parameter to the\nLoad­Keyboard­Layout<\/code> function.\nI mean, you can use this “technique” on the function\n<\/p>\n
\nvoid donothing(int i) { }\n<\/pre>\n
\nto demonstrate that the donothing<\/code> function has\nthe same “vulnerability”:\n<\/p>\n
\ndonothing(system(\"notepad.exe\"));\n<\/pre>\n
\nLogically, the compiler decomposes the call to\nLoad­Keyboard­Layout<\/code> function as\n<\/p>\n
\n auto param2 = system(\"notepad.exe\");\n LoadKeyboardLayout(\"whatever\", param2);\n<\/pre>\n
\nand now it’s clear that it’s not the\nLoad­Keyboard­Layout<\/code> function which is\nexecuting its second parameter; it’s you<\/i>.\n<\/p>\n
\nThis is like taking a printed picture of your friend into a secured area,\nthen saying,\n“See, I have a picture!\nYour security failed to stop me from taking a picture!”\nThat picture was taken outside the secured area.\nWhat you have is not a security vulnerability because the picture\nwas taken on the other side of the airtight hatchway.\n<\/p>\n
\nBefore contacting the submitter, we want to be sure that we weren’t\nmissing something,\nbut after looking at it from every angle, we still couldn’t see what\nthe issue was.\nWe ran the alleged exploit under the kernel debugger and traced\nthrough the entire\nLoad­Keyboard­Layout<\/code> function (both the user-mode\npart and the kernel-mode part)\nto confirm that the function never launched Notepad on its own.\nWe repeated the investigation on all service packs on all\nversions of Windows still under support (and even some that are\nno longer supported).\nStill nothing.\n<\/p>\n
\nStumped, we contacted the submitter.\n“From what we can tell, the call to system<\/code> takes place\nbefore you call the\nLoad­Keyboard­Layout<\/code> function.\nCan you elaborate on how this constitutes a vulnerability in the\nLoad­Keyboard­Layout<\/code> function?”\n<\/p>\n
\nApparently, the submitter didn’t quite understand what we were after,\nbecause the response was just more of the same.\n“I have discovered that the Visual Basic\nMsgBox<\/code> function\nhas a similar vulnerability:\n<\/p>\n
\nModule Program\nSub Main()\n MsgBox(System.Diagnostics.Process.Start(\"notepad.exe\").ToString())\nEnd Sub\nEnd Module\n<\/pre>\n
\nThe MsgBox<\/code> method will execute whatever you\npass as its parameter,\nas long as the result is a string.\n(You can even pass something that isn’t a string, but it’ll throw\nan exception after executing it.)\nThe documentation for MsgBox<\/code> clearly states that\nthe function displays a message box with the specified text.\nIt should therefore display a string and not execute a program!”\n<\/p>\n
\nAt this point,\nwe had to give up.\nWe couldn’t figure out what the person was trying to report,\nand our attempt to obtain a clarification was met with another version\nof what appeared to be the same nonsense.\nAs I recall, this entire investigation took five days to complete,\nplus another day or two to complete the necessary paperwork.\nEach year,\n\n200,000 vulnerability reports are received<\/a>,\nand each one is taken seriously,\n\neven the bogus-looking ones<\/a>,\nbecause there might be a real issue hiding behind a bogus-looking report.\nSort of how the people in the emergency communication center\nhave to follow through on every\n\n911<\/a>\ncall, even the ones that they strongly suspect are bogus,\nand even though dealing with the suspected-bogus ones\n\nslows down the overall response time for everyone<\/a>.\n<\/p>\n
\nThese sort-of-but-not-quite reports are among the most frustrating.\nThere’s enough sense in the report that it makes you wonder if there’s\na real vulnerability lurking in there, but which remains elusive because\nthe author is unable (perhaps due to a language barrier)\nto articulate it clearly.\nThey live in the shadowy ground between the reports that are\nclearly crackpot\nand the reports which are clear enough that you can evaluate them\nwith confidence.\nThese middle-ground reports are just plausible enough to be dangerous.\nAs a result, you close them out with trepidation,\nbecause there’s the risk\nthat there really is something there, but you just aren’t seeing it.\nThen you have nightmares that the finder has taken the report public,\nand the vulnerability report you rejected as bogus is now\nheadline news all over the technology press.\n(Or worse, exploits start showing up taking advantage of the vulnerability\nyou rejected as bogus two months ago.)\n<\/p>\n
\nUpdate<\/b>:\nSure, this looks like something you can reject out of hand.\nBut maybe there’s something there after all.\nPerhaps\nthe system<\/code> call somehow\n“primed the pump” and left the system in just the right state\nso that an uninitialized variable resulted in Notepad being\nlaunched a second time or editing its token to have higher\nprivileges.\nIn that case,\nyou rejected a genuine security vulnerability,\nand then when hackers start using it to build a botnet,\nsomebody will go back into the vulnerability investigation logs,\nand the only entry will be\n“Rejected without investigation by Bob.”<\/p>\n","protected":false},"excerpt":{"rendered":"
Today’s dubious security vulnerability comes from somebody who reported that the Load­Keyboard­Layout function had a security vulnerability which could lead to arbitrary code execution. This is a serious issue, but reading the report made us wonder if something was missing. \/\/ sample program to illustrate the vulnerability. #include <windows.h> #include <stdio.h> #include <stdlib.h> int __cdecl […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-8883","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"
Today’s dubious security vulnerability comes from somebody who reported that the Load­Keyboard­Layout function had a security vulnerability which could lead to arbitrary code execution. This is a serious issue, but reading the report made us wonder if something was missing. \/\/ sample program to illustrate the vulnerability. #include <windows.h> #include <stdio.h> #include <stdlib.h> int __cdecl […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/8883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=8883"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/8883\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=8883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=8883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=8883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}