4 ms·

Exploitability Assessment for Latest Software Release: 2 - Exploitation Less Likely Exploitability Assessment for Older Software Release: 2 - Exploitation Less

Exploitability Assessment for Latest Software Release: 2 - Exploitation Less Likely Exploitability Assessment for Older Software Release: 2 - Exploitation Less Likely Anyone with ideas on how they came to this conclusion? Yes, I read the linked document but felt that the index assessment didn't really reflect that google (Natalie?) seems to have found this "in the wild".

sigmar 9y ago
Not sure but the last comment on the bug report says: "RCE risk should be lowered due to CFG (on platforms where CFG is in effect)." >the index assessment didn't really reflect that google (Natalie?) seems to have found this "in the wild". Did she? How do you know this? edit: MS seems to explicitly say they are not aware of it being used. "Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security advisory was originally issued."
- jbergstroem 9y ago
  > Did she? How do you know this? Left column says: Finder-natashenka twitter.com/natashenka -> Natalie I added a "seems" since I wasn't sure, but let me use it again: there sure seems to be a connection.
  - ajdlinux 9y ago
    That doesn't address the "in the wild" part of your claim.
    - jbergstroem 9y ago
      You are right. That comment was based on this quote: "The debugging session below was captured after visiting a website that did this:" In hindsight: It can be interpreted in many ways and my standpoint was too pessimistic/bold from a security standpoint.
  - winteriscoming 9y ago
    A few days back there was a HN thread here talking about this tweet from Tavis[1] which involved Natashenka as well. I think it's related to this very issue. [1] https://twitter.com/taviso/status/860679110728622080 https://twitter.com/taviso/status/860679110728622080
- sqldba 9y ago
  What is "CFG"? Edit: Control Flow Guard. So software which is compiled with this specific flag in VS 2015+ isn't affected. That seems vague and unlikely to be very common.
  - goldfire 9y ago
    We're only talking about one exploit in one program. CFG doesn't have to be "common" to be relevant, it just has to have been used in that program, which it must be or it wouldn't have been mentioned.
  - moondrops 9y ago
    in this context, it's not vague nor likely to be uncommon. for the purposes of mitigating the vulnerability in msmpengine, what matters is that msmpengine has cfg enabled. whether other arbitrary programs on your computer have it too is not relevant to this story. cfg works like this: when a process has cfg enabled, the windows kernel will maintain a list of all valid indirect call targets for it, and then validates all indirect calls against this list. if validation fails (because the process attempted a call to an invalid target), the kernel terminates the process. obviously, this requires kernel cooperation. this was introduced in windows 8.1, which means windows defender on windows 7 can't use cfg there. cfg raises the bar a little in making it harder to obtain remote code execution from simple memory corruption, but doesn't make it impossible.
    - youdontknowtho 9y ago
      Is there an easy way to determine if CFG was used to build a binary? Thanks for the explanation, BTW.
      - CMay 9y ago
        If you have Visual Studio 2017 installed then you can use dumpbin to dump the PE headers of a binary. It's located under these directories: - C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.10.25017\bin\HostX64\x64\dumpbin.exe - C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.10.25017\bin\HostX64\x86\dumpbin.exe - C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.10.25017\bin\HostX86\x64\dumpbin.exe - C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.10.25017\bin\HostX86\x86\dumpbin.exe You can just setup a Visual Studio command prompt environment and run it: - cmd /k "C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\Common7\tools\VsDevCmd.bat" Then you can then call dumpbin on something like MsMpEng for a relevant example and filter for CFG related items: - dumpbin /headers /loadconfig "c:\program files\windows defender\msmpeng.exe" | findstr /i /c:"dll characteristics" /c:"control flow guard" /c:"guard cf" /c:"guard flags" /c:"cf instrumented" /c:"fid table present" The function count should be non-zero, the Control Flow Guard dll characteristics flag should be set, then the CF Instrumented and FID Table Present guard flags should be set. Be aware that this filters out a lot of other details and misrepresents the full list of flags.
lawnchair_larry 9y ago
This was not found in the wild.

sigmar 9y ago

Not sure but the last comment on the bug report says: "RCE risk should be lowered due to CFG (on platforms where CFG is in effect)." >the index assessment didn't really reflect that google (Natalie?) seems to have found this "in the wild". Did she? How do you know this? edit: MS seems to explicitly say they are not aware of it being used. "Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security advisory was originally issued."

jbergstroem 9y ago
> Did she? How do you know this? Left column says: Finder-natashenka twitter.com/natashenka -> Natalie I added a "seems" since I wasn't sure, but let me use it again: there sure seems to be a connection.
- ajdlinux 9y ago
  That doesn't address the "in the wild" part of your claim.
  - jbergstroem 9y ago
    You are right. That comment was based on this quote: "The debugging session below was captured after visiting a website that did this:" In hindsight: It can be interpreted in many ways and my standpoint was too pessimistic/bold from a security standpoint.
- winteriscoming 9y ago
  A few days back there was a HN thread here talking about this tweet from Tavis[1] which involved Natashenka as well. I think it's related to this very issue. [1] https://twitter.com/taviso/status/860679110728622080 https://twitter.com/taviso/status/860679110728622080
sqldba 9y ago
What is "CFG"? Edit: Control Flow Guard. So software which is compiled with this specific flag in VS 2015+ isn't affected. That seems vague and unlikely to be very common.
- goldfire 9y ago
  We're only talking about one exploit in one program. CFG doesn't have to be "common" to be relevant, it just has to have been used in that program, which it must be or it wouldn't have been mentioned.
- moondrops 9y ago
  in this context, it's not vague nor likely to be uncommon. for the purposes of mitigating the vulnerability in msmpengine, what matters is that msmpengine has cfg enabled. whether other arbitrary programs on your computer have it too is not relevant to this story. cfg works like this: when a process has cfg enabled, the windows kernel will maintain a list of all valid indirect call targets for it, and then validates all indirect calls against this list. if validation fails (because the process attempted a call to an invalid target), the kernel terminates the process. obviously, this requires kernel cooperation. this was introduced in windows 8.1, which means windows defender on windows 7 can't use cfg there. cfg raises the bar a little in making it harder to obtain remote code execution from simple memory corruption, but doesn't make it impossible.
  - youdontknowtho 9y ago
    Is there an easy way to determine if CFG was used to build a binary? Thanks for the explanation, BTW.
    - CMay 9y ago
      If you have Visual Studio 2017 installed then you can use dumpbin to dump the PE headers of a binary. It's located under these directories: - C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.10.25017\bin\HostX64\x64\dumpbin.exe - C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.10.25017\bin\HostX64\x86\dumpbin.exe - C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.10.25017\bin\HostX86\x64\dumpbin.exe - C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.10.25017\bin\HostX86\x86\dumpbin.exe You can just setup a Visual Studio command prompt environment and run it: - cmd /k "C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\Common7\tools\VsDevCmd.bat" Then you can then call dumpbin on something like MsMpEng for a relevant example and filter for CFG related items: - dumpbin /headers /loadconfig "c:\program files\windows defender\msmpeng.exe" | findstr /i /c:"dll characteristics" /c:"control flow guard" /c:"guard cf" /c:"guard flags" /c:"cf instrumented" /c:"fid table present" The function count should be non-zero, the Control Flow Guard dll characteristics flag should be set, then the CF Instrumented and FID Table Present guard flags should be set. Be aware that this filters out a lot of other details and misrepresents the full list of flags.

lawnchair_larry 9y ago

This was not found in the wild.