7 ms·
CVE-2019-1347: When a mouse over a file is enough to crash your system
- leetrout 7y agoI assume the audience of a post like this is other security researchers? That's a radical piece of software, though. I've never seen anything like that before. The text and technical details supporting the screen caps is very dense and hard to approach as a complete outsider. I would love to have a glossary with all the terms and initialisms/acronyms in use. PTE (apparently means page table entry), for example, is something I've never heard of before.
- inetknght 7y ago> I assume the audience of a post like this is other security researchers? Or "low level/back end" developers; people knowledgeable with operating systems, assembly, and hardware.
- deleted 7y ago[deleted]
- saagarjha 7y agoThe format wasn’t particularly great even to someone who’s interested in the field and familiar with dynamic taint analysis (but not an expert :) ). The issue was that it focused a bit too heavily on showing what their product could do, so it had a lot of videos instead of a more tractable “our taint analysis tool shows that the lower four bits of this byte come from byte three of the PE header after it’s passed through x, y, and z”. (Page table entries are used to implement virtual memory, though expanding the acronym at least once would have been helpful. That being said, the code mentions page tables multiple times.)
- stevemk14ebr 7y agoI'm in the security field and do work similar to this professionally. This article it poorly written and i found the videos shown absolutely useless. If you want to see how technical articles should read, take a look at j00ru's blog (research that found this). That is how you write about this stuff.
- sqldba 7y agoThank goodness! I looked at the article and it made me mad because it seemed to be a bunch of nonsense. I mean the second video paragraph is: "A closer look at the memcpy arguments shows that this address is built as 0xfffff8035b2a0000 + 0xe7ff, so we taint the value 0xe7ff to find where it comes from." But there's absolutely zero explanation of what we're looking at. So it made me mad because it made me feel stupid for not understanding it, when in reality it's just poorly written. Poor communication is theft.
- petschge 7y agoThis issue apparently affected Windows 8.1, Windows 10 and their corresponding Server editions (32-bit and 64-bit) and has been patched since October 8th.
- temac 7y agoThe real question is: why the fuck the kernel parses the PE on just a mouse over... it like Windows is asking for vulns with even more impact :/
- rincebrain 7y agoIt displays an overlay when you hover the mouse over a PE executable with information like the author/company/version/date created. The fact that it does this in the kernel is foolish, but there's functionality directly tied to this, not an indirect chain of things that results in parsing this for little reason.
- malux85 7y agoNobody is contesting that there’s a chain of events that leads to this, but doing this in the kernel is not “foolish” - it’s batshit insane, amateurish and frankly laughable.
- barrkel 7y agoTypically these things happen because people want to reuse code. There's some code that parses executables, there's a bit of shell that wants to display information from an executable, and someone joins the two together without understanding the ramifications.
- c256 7y agoI would argue that the stronger reason is that Windows typically doesn’t enforce, allow, or contains any distinction between kernel code and user-space code. This happens because there is a gigantic gravity well of pre-existing code that predates and/or precludes real separation, and the costs of concretely losing that support was nearly always judged higher than the abstract benefit of adding separation. One old example: I have an old friend who used to do sysadmin work in the Windows 2k days, and he would often get gigs by speeding up services by 5-15% within a day. His go-to trick was to log into the headless win2k server and disable the screensaver process, then wait.
- jacquesm 7y agoOne more bit of proof that if you want proper isolation you should not bloat your kernel. All this stuff belongs in userland. At least there the damage will be limited.
- dwoozle 7y agoWhat would the behavior be if this happened in user space?
- drjasonharrison 7y agoFile browser / user session would crash.
- dwoozle 7y agoIs that less bad? Wouldn’t that nuke the experience too?
- mey 7y agoWhen explorer (the shell and file browser, don't know if those are fully separate under Win 10) crashes, it is automatically restarted and would not close any other running programs and would not log you out.
- userbinator 7y ago...and that's probably the reason why they don't seem to get fixed. I've had clean installs of Win10 and 8.1 crash it often, just by browsing through a lot of files.
- milankragujevic 7y agoThats a regular occurrence for me and people I know. My boss inserted a USB drive and Explorer crashed. It restarted itself, but crashed again. Until the drive was unplugged, at which time Windows made a bunch of error noises and popped up a "Catastrophic failure" dialog. It then worked OK after the USB drive was reinserted. The laptop cost ~3500€ and was installed and set up by the IT department with extra care because it's for the boss. It didn't matter, Windows 10 doesn't pick it's victims.
- m712 7y agoThe images in the article will stay a blurry mess without Javascript and will not load. Please don't do this. Use progressive images. EDIT: Apparently they are videos, but you can still add thumbnail images to native HTML5 videos without loading 40 script files (that uMatrix reported).