4 ms·

Windows 8 Kernel Memory Protections Bypass

77 points by flurpitude 12y ago

acqq 12y ago
So it's just an "if we would have a hole, we could use it." They used the "recently patched" hole (that is, the unpatched system) for their submission to Microsoft, and the custom kernel driver they crafted for this article. Unsurprisingly, Microsoft's response was "yes, we know, no, you don't qualify."
- Someone1234 12y ago
  It is an impressive piece of research that bypasses several key pieces of kernel protection. It could definitely be utilised by a kernel mode exploit in the future to expand limited access into a full blown piece of running kernel code. I don't really have an opinion on Microsoft's response one way or the other. They get to set the rules on their own bug bounty and that is that. Also to fix this would almost certainly require a large scale kernel re-write (as the article itself alludes to).
  - acqq 12y ago
    As far as I understand, their demo is dependent on their kernel mode driver through which a user mode application can write to any memory address with the "root" privileges. So it demonstrates that if you already have the "root" "write" privileges, you can bypass the protections provided by the kernel. I fail to see what exactly is impressive then. Raymond Chen would probably cite the following segment from "The Hitchhiker's Guide to the Galaxy" ""We're trapped now aren't we?" "Yes," said Ford, "we're trapped." "Well didn't you think of anything? I thought you said you were going to think of something. Perhaps you thought of something and didn't notice." "Oh yes, I thought of something," panted Ford. Arthur looked up expectantly. "But unfortunately," continued Ford, "it rather involved being on the other side of this airtight hatchway." He kicked the hatch they'd just been through."
- makomk 12y ago
  The mitigations they're talking about bypassing are, like all mitigation techniques, intended to ensure that if someone has a security hole they cannot make use of it. That's their entire point; if there were no security holes, there'd be no need for stuff like DEP, SMEP, and ASLR in the first place. In practice that's not a realistic assumption, which is why companies like Intel have gone to the trouble of adding hardware features that have zero benefit unless there's a security hole in the operating system.
  - acqq 12y ago
    DEP, SMEP, ASLR are there to make the user-mode exploits harder. But if that bypass depends on having the "root" "write anywhere" hole, well, it uses the quite a big hole, and they just demonstrate that it is actually a big one. As far as I undestand, DEP and SMEP simply use the VM page flags controlled by the "root." The article authors depend on having the "root" write access to the given flags, and then they claim that they "bypass" DEP and SMEP, whereas they actually change the mentioned flags. They also explain that as soon as they have that, they simply aren't constrained by the ASLR at all.
twoodfin 12y ago
In case you're a little confused, as I was, by the step from "can tag arbitrary user memory as kernel executable" to "get the kernel to execute it", the technique used by the PoC is (apparently) well-known enough not to mention: http://poppopret.blogspot.com/2011/07/windows-kernel-exploitation-basics-part.html http://poppopret.blogspot.com/2011/07/windows-kernel-exploit... Short version: You can overwrite a function pointer entry in the HAL dispatch table that will be called by NtQueryIntervalProfile().
- umanwizard 12y ago
  They allude to this in the introduction: "requires only a single vulnerability that provides an attacker with a write-what-where primitive"
tormeh 12y ago
A meta question: Why is this post so high on HN? It's not particularly new and it doesn't have particularly many upvotes. Does HN have a list of websites/blogs it prefers? I'm not saying this post is bad though it is outside my field of interest, but I don't really understand the ranking mechanism.
- j_s 12y ago
  I did not see anything on your profile to contact you directly, so I will share this here: How Hacker News ranking really works https://news.ycombinator.com/item?id=6799854 https://news.ycombinator.com/item?id=6799854 (~9 months old) How Hacker News ranking algorithm works https://news.ycombinator.com/item?id=1781013 https://news.ycombinator.com/item?id=1781013 (~4 years old) Hacker News Charts and Data https://news.ycombinator.com/item?id=8075216 https://news.ycombinator.com/item?id=8075216 (~1 month old) Hacker News Rankings http://hnrankings.info/ http://hnrankings.info/
- deleted 12y ago
  [deleted]
thefreeman 12y ago
The blog post mentions PoC code but I couldn't find it linked anywhere? Anyone find it?
pwnfl4k3s 12y ago
the point of this is simple: if you have a kernel vulnerability that allows you to construct a write-what-where primitive (or even something lower like an arbitrary inc/dec, although it is most of the time possible to transform vulnerabilities into the former mentioned), you are able to turn it into a fully blown kernel-mode code-execution using that technique. this is what bypassing mitigation-techniques is all about: turning a vulnerability into code-execution. in particular, the technique eliminates the need to use ROP in order to bypass SMEP and DEP, this is why it is a big deal. the only reason that it was not considered eligible for microsofts Bluehat-Program is the fact that it is a kernel-land mitigation bypass, not a userland one.
- drvdevd 12y ago
  What seems even more interesting about it, is that it's directly related to the paging structures in x64, making it potentially applicable to kernel mode exploit mitigations on any OS running there (MacOS X for example). It's a great example of why kernel mode exploit mitigation is unlikely to ever reach the same level of effectiveness as in user mode.

77 points by flurpitude 12y ago

acqq 12y ago

So it's just an "if we would have a hole, we could use it." They used the "recently patched" hole (that is, the unpatched system) for their submission to Microsoft, and the custom kernel driver they crafted for this article. Unsurprisingly, Microsoft's response was "yes, we know, no, you don't qualify."

Someone1234 12y ago
It is an impressive piece of research that bypasses several key pieces of kernel protection. It could definitely be utilised by a kernel mode exploit in the future to expand limited access into a full blown piece of running kernel code. I don't really have an opinion on Microsoft's response one way or the other. They get to set the rules on their own bug bounty and that is that. Also to fix this would almost certainly require a large scale kernel re-write (as the article itself alludes to).
- acqq 12y ago
  As far as I understand, their demo is dependent on their kernel mode driver through which a user mode application can write to any memory address with the "root" privileges. So it demonstrates that if you already have the "root" "write" privileges, you can bypass the protections provided by the kernel. I fail to see what exactly is impressive then. Raymond Chen would probably cite the following segment from "The Hitchhiker's Guide to the Galaxy" ""We're trapped now aren't we?" "Yes," said Ford, "we're trapped." "Well didn't you think of anything? I thought you said you were going to think of something. Perhaps you thought of something and didn't notice." "Oh yes, I thought of something," panted Ford. Arthur looked up expectantly. "But unfortunately," continued Ford, "it rather involved being on the other side of this airtight hatchway." He kicked the hatch they'd just been through."
makomk 12y ago
The mitigations they're talking about bypassing are, like all mitigation techniques, intended to ensure that if someone has a security hole they cannot make use of it. That's their entire point; if there were no security holes, there'd be no need for stuff like DEP, SMEP, and ASLR in the first place. In practice that's not a realistic assumption, which is why companies like Intel have gone to the trouble of adding hardware features that have zero benefit unless there's a security hole in the operating system.
- acqq 12y ago
  DEP, SMEP, ASLR are there to make the user-mode exploits harder. But if that bypass depends on having the "root" "write anywhere" hole, well, it uses the quite a big hole, and they just demonstrate that it is actually a big one. As far as I undestand, DEP and SMEP simply use the VM page flags controlled by the "root." The article authors depend on having the "root" write access to the given flags, and then they claim that they "bypass" DEP and SMEP, whereas they actually change the mentioned flags. They also explain that as soon as they have that, they simply aren't constrained by the ASLR at all.

twoodfin 12y ago

In case you're a little confused, as I was, by the step from "can tag arbitrary user memory as kernel executable" to "get the kernel to execute it", the technique used by the PoC is (apparently) well-known enough not to mention: http://poppopret.blogspot.com/2011/07/windows-kernel-exploitation-basics-part.html http://poppopret.blogspot.com/2011/07/windows-kernel-exploit... Short version: You can overwrite a function pointer entry in the HAL dispatch table that will be called by NtQueryIntervalProfile().

umanwizard 12y ago
They allude to this in the introduction: "requires only a single vulnerability that provides an attacker with a write-what-where primitive"

tormeh 12y ago

A meta question: Why is this post so high on HN? It's not particularly new and it doesn't have particularly many upvotes. Does HN have a list of websites/blogs it prefers? I'm not saying this post is bad though it is outside my field of interest, but I don't really understand the ranking mechanism.

j_s 12y ago
I did not see anything on your profile to contact you directly, so I will share this here: How Hacker News ranking really works https://news.ycombinator.com/item?id=6799854 https://news.ycombinator.com/item?id=6799854 (~9 months old) How Hacker News ranking algorithm works https://news.ycombinator.com/item?id=1781013 https://news.ycombinator.com/item?id=1781013 (~4 years old) Hacker News Charts and Data https://news.ycombinator.com/item?id=8075216 https://news.ycombinator.com/item?id=8075216 (~1 month old) Hacker News Rankings http://hnrankings.info/ http://hnrankings.info/
deleted 12y ago
[deleted]

thefreeman 12y ago

The blog post mentions PoC code but I couldn't find it linked anywhere? Anyone find it?

pwnfl4k3s 12y ago

the point of this is simple: if you have a kernel vulnerability that allows you to construct a write-what-where primitive (or even something lower like an arbitrary inc/dec, although it is most of the time possible to transform vulnerabilities into the former mentioned), you are able to turn it into a fully blown kernel-mode code-execution using that technique. this is what bypassing mitigation-techniques is all about: turning a vulnerability into code-execution. in particular, the technique eliminates the need to use ROP in order to bypass SMEP and DEP, this is why it is a big deal. the only reason that it was not considered eligible for microsofts Bluehat-Program is the fact that it is a kernel-land mitigation bypass, not a userland one.

drvdevd 12y ago
What seems even more interesting about it, is that it's directly related to the paging structures in x64, making it potentially applicable to kernel mode exploit mitigations on any OS running there (MacOS X for example). It's a great example of why kernel mode exploit mitigation is unlikely to ever reach the same level of effectiveness as in user mode.