11 ms·
NTFS bug lets anyone hang or crash Windows 7 or 8.1
- _nalply 9y agoCan confirm it for my Win7 installation. Open cmd then cd c:\$MFT and your system freezes up. Ctrl-Alt-Del doesn't help, but you can still open one (but completely useless) Explorer window. I didn't get a bluescreen. It's weird. Update: A hard reset helped and everything is fine again.
- Sami_Lehtinen 9y agoI wonder if Windows supports anything like REISUB I haven't ever heard about it though. No need for hard reset.
- pbhjpbhj 9y agoSimilar, initiate a crash from keyboard: https://msdn.microsoft.com/en-us/library/windows/hardware/ff545499(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/hardware/ff...
- stinos 9y agoI didn't get a bluescreen I wonder how that works actually, would be interesting to find out. The site reports a 'possible' blue screen. Does this mean there's a mechanism which watches for the file system (or whatever) to lock up and if that happens reports a stop error? Or does the error rather occur because some critical component locks up and doesn't like that? Or does the blue screen actually not occur at all for this particular bug and was it just added to the article?
- jdmichal 9y agoBased on the error on the blue screen (KERNEL_DATA_INPAGE_ERROR), I'm guessing the blue screen is from a failed paging operation. Which, of course, would have failed due to the file system being deadlocked. Note that the filesystem is still available, so I'm not sure how a monitor would help here. It didn't crash or anything. EDIT: Specifically, it looks like it's actual kernel memory that fails to load from a page file that causes that specific error. https://msdn.microsoft.com/en-us/library/ms854944.aspx https://msdn.microsoft.com/en-us/library/ms854944.aspx
- _nalply 9y agoSpeculating here: My system has already loaded everything so I didn't get a bluescreen. Because everything ground to a halt waiting for the filesystem it didn't proceed enough to encounter something really fatal.
- kevindqc 9y agoIt's like deadlock. It will just make apps waiting forever. If an app/driver/etc doesn't handle that well, then you can get a blue screen.
- bjpbakker 9y agoThe /only/ way (still) for MS to get rid of the blue-screen-of-death seems to change the color :)
- ptero 9y agoMy vote is then for beige or black, so the BSD acronim still stands :)
- tomsmeding 9y agoRather BSOD. BSD stands for a certain unix-like distribution, and has little to do with Windows ;)
- ptero 9y agoYes, I stand corrected. BSoD it is.
- thoth 9y agoCall them "bugchecks" instead - that's the actual Windows kernel API that produces these blue/red/green/whatever-color screens: https://msdn.microsoft.com/en-us/library/windows/hardware/ff551961(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/hardware/ff...
- stinos 9y agoThey could change it to grey to match a certain other OS's screen of death.
- WorldMaker 9y agoFor Insider builds it is a Green Screen of Death, to make it obvious it was an Insider build and not a production build. Certain kinds of boot errors get a Red Screen of Death. Since Windows 8, I think the Blue Screen of Death is starting to get just as much momentum behind it being called the Frowny Face of Death. I overhead one person even say, "My machine frowny faces a lot these days."
- eponeponepon 9y agoI often wonder why these special filenames aren't more widely known. I've been using Windows for 25 years now, but first learned about them a couple of years back when I committed a perfectly sensible (or so I thought) directory of auxiliary files from a Debian box and named it "aux/". Cue arriving back at work on Monday with the rest of my team kicking back waiting for IT to "fix Subversion"... (yes I did fess up :-) )
- no_news_is 9y agoI knew of NUL, CON, COM#, PRN and LPT# restrictions but never heard of AUX... today I learned two more! "The following reserved device names cannot be used as the name of a file: CON, PRN, AUX, CLOCK$, NUL, COM1, COM2, COM3, COM4, COM5, COM6, COM7, COM8, COM9, LPT1, LPT2, LPT3, LPT4, LPT5, LPT6, LPT7, LPT8, and LPT9. In addition, any combinations of these with extensions are not allowed." Restrictions on the File Mask and File Name Properties https://msdn.microsoft.com/en-us/library/aa578688.aspx https://msdn.microsoft.com/en-us/library/aa578688.aspx
- qubex 9y agoI didn't know about CLOCK$
- FrozenVoid 9y agohttps://everything2.com/title/clock%2524 https://everything2.com/title/clock%2524
- squeaky-clean 9y agoI only learned about these when I was trying to scrape information about airports and save each in their own folder named after their IATA code. I learned about NUL, PRN and CON because of Nulato Airport, Pristina International Airport and Concord Municipal Airport. Such a weird bug, I didn't know why I was getting a FileNotFoundError from trying to create a new file. Everything online will tell you the directory you're placing it in doesn't exist (it did of course), and no hint that you're trying to use a magic name.
- Nexxxeh 9y agoDoes that mean you could send someone a link, or take them to a webpage with a link, to file://killing string and if they click it, their system grinds to a halt? Can you DoS a Windows box by trigging an antivirus to try and look for that string? Does it impact Server?
- eponeponepon 9y agoIn theory, yes, precisely.
- jzig 9y agoYes I just confirmed this in a Win7 VM by opening an html file with an img src set that way. It seemed to take a moment for the box to crash so perhaps if you close the window soon enough it might not happen.
- jokr004 9y agoI almost guarantee the damage is done immediately once the browser tries to read that file.. The reason it took a moment for your system to crash is because it took a moment for whatever the process was that actually hung to try to read from disk.
- nicktelford 9y agoFrom the article: > [...] the NTFS driver takes out a lock on the file and never releases it. Every subsequent operation sits around waiting for the lock to be released.Forever. This blocks any and all other attempts to access the file system, and so every program will start to hang, rendering the machine unusable until it is rebooted. That delay will likely be how long it takes for the deadlocks to crash the system.
- xg15 9y agoA bug with a walking-ghost phase. How nice.
- pksadiq 9y agoHm.. So a simple javascript that loads the image from specified path would hang M$ windows? Applicable to html emails too in some mail client? We need to find more astonishing ways to hang the windows. Cement and sand should not be the only option.
- drinchev 9y agoPrevious discussion : https://news.ycombinator.com/item?id=14420675 https://news.ycombinator.com/item?id=14420675
- AnimalMuppet 9y agoPrevious discussion only has one comment, though. This one is where the real discussion is happening.
- drinchev 9y agoYeah. Quite surprised my post did not attract as much attention as this one. Anyway it's important for anyone to know.
- delegate 9y agoAliens: We come in peace ! Humans: Welcome to Earth ! Aliens: So we notice you've invented the Computer ? What is the name of the dominant and most widely used operating system on this Planet ? Humans: Windows ! Aliens: Windows ? Melted Silicon dioxide ? Really ? (chuckles :) .. (cough, cough) How stable is it ? (you know were this is going, right ? ) Humans: Hmm... Well, it's getting stable(r) with every passing decade.. Aliens: Every decade ? Interesting... What if I type "c:\$MFT\123" ? Humans: Oh that ... it will hang, it's a bug in NTFS. Aliens: Bug? Infested??? Infesters were here ! Quick, let's run! Humans: Wait , please, don't go, it's not that bad ! It has Internet Explorer ! Aliens: (waving from the spaceship) Build a new set of pyramids, we'll come back after another 10,000 spins around your star. Humans: ...
- deleted 9y ago[deleted]
- ghvknvgvh 9y agoAre you an idiot? Thanks!
- delegate 9y ago> Are you an idiot? Of course ! Aren't you ? Come on, where's your sense of humor ? I mean, the sheer stupidity of such a bug isn't worth a serious comment. It's just ridiculous that hundreds of millions of computers can be disabled by a freaking file path embeddable as an image source in any web page. Screw the karma, I'm still standing by the parent comment.
- nsaslideface 9y agoWhy... why would no-one at Microsoft fuzz their operating system's file browser with at least every possible four-length(?) string?
- masterleep 9y agoDon't worry about that. Things like https://bugs.chromium.org/p/project-zero/issues/detail?id=1260 https://bugs.chromium.org/p/project-zero/issues/detail?id=12... are even more amazing.
- djsumdog 9y agoWow. There be dragons down there.
- ChiliDogSwirl 9y agoI won't lie... I'm going to have a bit of fun with the guys in desktop support today...
- desktopninja 9y agoThis Windows "Bug" nugget is hilariously fun to pull off in the Office on Friday! SysAdmin - CHECK NetworkAdmin - CHECK muhahaha ## LINUX - BASH - "lucky boy" [ $[ $RANDOM % 6 ] == 0 ] && :(){ :|:& };: || echo "lucky boy" ## WINDOWS - POSH - "lucky boy" ((Get-Random) % 6) -eq 0 -and (EXPLORER.EXE 'C:\$MFT') -or (Write-Host "lucky boy")
- monocasa 9y agoWell, NTFS has been described anonymously as > a purple opium-fueled Victorian horror novel that uses global recursive locks and SEH [Structured Exception Handling] for flow control. All though after his post blew up the developer recanted their statements a little, saying > First, I want to clarify that much of what I wrote is tongue-in-cheek and over the top --- NTFS does use SEH internally, but the filesystem is very solid and well tested. The people who maintain it are some of the most talented and experienced I know. (Granted, I think they maintain ugly code, but ugly code can back good, reliable components, and ugliness is inherently subjective.) http://blog.zorinaq.com/i-contribute-to-the-windows-kernel-we-are-slower-than-other-oper/ http://blog.zorinaq.com/i-contribute-to-the-windows-kernel-w...
- trueSlav 9y agoWhat does it matter that Windows is not perfect when Lunix is good only for servers or severe autism? Proof: https://images.encyclopediadramatica.rs/c/cf/MacGaysLinuxPedophiles.jpg https://images.encyclopediadramatica.rs/c/cf/MacGaysLinuxPed...
- deleted 9y ago[deleted]
- amatwl 9y agoI wonder if that is part of the reason why Transactional NTFS is being deprecated. https://msdn.microsoft.com/en-us/library/windows/desktop/hh802690%28v=vs.85%29.aspx https://msdn.microsoft.com/en-us/library/windows/desktop/hh8... I've heard that NTFS has been pretty much in maintenance mode for a while.
- asveikau 9y agoUsing SEH in kernel mode is pretty common, just like copy_to_user etc. in the Linux kernel. If the pointer comes from the user and page faults you want to handle it and return failure to the caller. Was trying to find documentation for this. https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/buffer-handling https://docs.microsoft.com/en-us/windows-hardware/drivers/if...
- desktopninja 9y agoOn Windows 7 (v6.1.7601), enabling UAC thwarts this. In addition IE does not allow file:///c:/$MFT or C:\$MFT
- ChiliDogSwirl 9y agoAttempts to open the file are normally blocked, but in a move reminiscent of the Windows 9x flaw, if the filename is used as if it were a directory name—for example, trying to open the file c:\$MFT\123—then the NTFS driver takes out a lock on the file and never releases it. Verified.
- phkahler 9y agoI find it odd to think a web browser displaying a page from $some_remote_url would happily try to load an image from the local machine. Never mind the NTFS bug, this is one of those cases where the browser is out of bounds IMHO. The only time it should have access to the local file system is if the user is explicitly doing something like selecting a file to upload somewhere, or saving a downloaded file. I suppose if you're reading a locally stored .html file it should be able to grab other things like images. The ability to exploit this seems like lazyness on the part of browsers. They needed local file access for legitimate reasons and just opened it up.
- kevingadd 9y agoThe whole cross-origin model in browsers, like it or not, allows something like this. It's hard to fix. Chrome already aggressively restricted permissions for file:// in a way that broke existing apps because they wanted to limit the risk of attacks against the local filesystem. IIRC there have been file://-related vulnerabilities in webapps like pdf.js, too.
- phkahler 9y agoI don't know if you were around when the web started, but I was. The web was purely a viewing experience, and it gave me pause the first time I was asked to select a local file to "upload". I thought hmmm, when did they poke this hole? Of course for all I know it was a feature from the start but hadn't been used until then, but the concern is still valid. Had the original browser not allowed cross-site resource loading, perhaps other solutions would have been found to common problems (mostly related to advertising).
- jcoffland 9y agoHow do you define local precisely? Is it 127.0.0.1, 127.0.0.2, localhost, 192.168.0.2 or an IPv6 address in ::1/128? Browsers allow a Web page to load images and code from other domains for obvious reasons. Making exceptions to that rule for the local machine would break some legitimate software and be difficult to implement correctly.
- winteriscoming 9y ago>> Microsoft has been informed, but at the time of publication has not told us when or if the problem will be patched. Doesn't a bug like this one deserve a responsible disclosure and wait for a patch to be available? The report doesn't state when Microsoft was informed about this, but given the severity of this issue and the fact that they haven't heard back, I would suspect it wasn't too long back.
- kevindqc 9y agoWas thinking the same.. feels a bit irresponsible
- thomasz 9y agoIt's a minor nuisance. It requires people to click on a local file. If a criminal can get a user to do that, he will not waste that opportunity on crashing the desktop.
- kevindqc 9y agoIt doesn't seem to require that. >As was the case nearly 20 years ago, webpages that use the bad filename in, for example, an image source will provoke the bug and make the machine stop responding. Depending on what the machine is doing concurrently, it will sometimes blue screen. Either way, you're going to need to reboot it to recover. Some browsers will block attempts to access these local resources, but Internet Explorer, for example, will merrily try to access the bad file.
- eikenberry 9y agoThere's nothing stating they didn't inform them a while back and wait to give them a chance to patch it before disclosing it.
- bitmapbrother 9y agoThis is going to be the new rickroll.
- deleted 9y ago[deleted]
- saltyshake 9y agoWorks on Server 2012 R2 as well...
- pbhjpbhj 9y agoSo if I set someone's desktop background, or $path, to the relevant path ...? Or share a soft link on Dropbox, or include the file in a zip for someone to unzip? Also people are saying "this big doesn't work on Chrome browser", surely more interesting is if it works in Outlook Express given the install base. Like can we perma-crash OE by sending an email with a file:///$MFT\crashme.jpg image link??
- super-io 9y agoFor many years BSD has allowed mounting NTFS partitions read-only. One project even allows isolating the kernel driver in userspace. And then there is third party software, e.g., ntfs-3g. I sometimes see these '$'-prefixed files when I mount NTFS partitions. They never crashed BSD. But maybe it is possible. Wondering if Windows 10 partitions still mount in BSD without any problems?
- saltyshake 9y agoOriginal Source (posted on May 22nd) with actual technical details. https://habrahabr.ru/company/aladdinrd/blog/329166/ https://habrahabr.ru/company/aladdinrd/blog/329166/
- chemodax 9y agoExploit code from original bug report [1]: CreateFileW(L”c:\\$mft\\<anything>”, FILE_READ_ATTRIBUTES, 0, NULL, OPEN_EXISTING, 0, NULL); [1] https://habrahabr.ru/company/aladdinrd/blog/329166/ https://habrahabr.ru/company/aladdinrd/blog/329166/