Document Title: =============== Lenovo SU v5.07 - Buffer Overflow & Code Execution Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2131 Lenovo Security ID: LEN-19625 https://nvd.nist.gov/vuln/detail/CVE-2018-9063 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9063 Acknowledgements: https://support.lenovo.com/us/fr/solutions/len-19625 News & Press References: https://www.securityweek.com/lenovo-patches-secure-boot-vulnerability-servers https://securityaffairs.co/wordpress/72335/security/lenovo-security-updates.html http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-9063 CVE-ID: ======= CVE-2018-9063 Release Date: ============= 2018-07-12 Vulnerability Laboratory ID (VL-ID): ==================================== 2131 Common Vulnerability Scoring System: ==================================== 7.8 Vulnerability Class: ==================== Buffer Overflow Current Estimated Price: ======================== 4.000a! - 5.000a! Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered a local buffer overflow vulnerability in the official Lenovo SU v5.7.x & v5.6.x. software. Vulnerability Disclosure Timeline: ================================== 2018-05-03: Release Date (Lenovo) 2018-07-12: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Lenovo Product: SU (MapDrv - mapdrv.exe) 5.7.19, 5.6.34, 5.6.0.28 & 5.6.0.27 Exploitation Technique: ======================= Local Severity Level: =============== High Authentication Type: ==================== Restricted authentication (user/moderator) - User privileges User Interaction: ================= No User Interaction Disclosure Type: ================ Responsible Disclosure Program Technical Details & Description: ================================ A local buffer overflow and arbitrary code exeuction has been discovered in the official Lenovo SU v5.7.x & v5.6.x. software. The vulnerability allows to overwrite the active registers of the process to compromise the affected software by gaining higher system access privileges. MapDrv (C:Program FilesLenovoSystem Update mapdrv.exe) contains a local vulnerability where an attacker entering very large user ID or password can overrun the programas buffer, causing undefined behaviors, such as execution of arbitrary code. No additional privilege is granted to the attacker beyond what is already possessed to run MapDrv. The flaw could be exploited by local attackers for different kind of attacks, include the execution of arbitrary code on the target machine. Exploitation of the local buffer overflow vulnerability requires no user interaction and system user process privileges of the driver. Successful exploitation of the buffer overflow vulnerability results in a compromise of the local system process or affected computer system. Vulnerable Driver: [+] MapDrv Affected Process: [+] mapdrv.exe Proof of Concept (PoC): ======================= The vulnerability can be exploited by local attackers with system process privileges and without user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below. --- Debug Error Exception Session Log (Exception) --- (d8c.1988): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=029ab7a0 ebx=0031fe05 ecx=00000041 edx=fd974860 esi=029a9d70 edi=0031fd04 eip=00a256b3 esp=0031e54c ebp=0031fc70 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206 *** ERROR: Module load completed but symbols could not be loaded for image00a20000 image00a20000+0x56b3: 00a256b3 66890c02 mov word ptr [edx+eax],cx ds:0023:00320000=0000 --- Debug Session Log [Exception Analysis] --- FAULTING_IP: image00a20000+56b3 00a256b3 66890c02 mov word ptr [edx+eax],cx EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff) ExceptionAddress: 00a256b3 (image00a20000+0x000056b3) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 00320000 Attempt to write to address 00320000 FAULTING_THREAD: 00001988 PROCESS_NAME: image00a20000 FAULTING_MODULE: 77ab0000 ntdll DEBUG_FLR_IMAGE_TIMESTAMP: 594b6578 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. WRITE_ADDRESS: 00320000 BUGCHECK_STR: ACCESS_VIOLATION IP_ON_HEAP: 00410041 The fault address in not in any loaded module, please check your build's rebase log at <releasedir>binbuild_logstimebuildntrebase.log for module which may contain the address if it were loaded. DEFAULT_BUCKET_ID: WRONG_SYMBOLS FRAME ONE INVALID: 1800200000000a LAST_CONTROL_TRANSFER: from 00410041 to 00a256b3 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. 0031fc70 00410041 00410041 00410041 00410041 image00a20000+0x56b3 0031fc74 00410041 00410041 00410041 00410041 0x410041 0031fc78 00410041 00410041 00410041 00410041 0x410041 0031fc7c 00410041 00410041 00410041 00410041 0x410041 0031fc80 00410041 00410041 00410041 00410041 0x410041 0031fc84 00410041 00410041 00410041 00410041 0x410041 0031fc88 00410041 00410041 00410041 00410041 0x410041 0031fc8c 00410041 00410041 00410041 00410041 0x410041 0031fc90 00410041 00410041 00410041 00410041 0x410041 0031fc94 00410041 00410041 00410041 00410041 0x410041 0031fc98 00410041 00410041 00410041 00410041 0x410041 0031fc9c 00410041 00410041 00410041 00410041 0x410041 0031fca0 00410041 00410041 00410041 00410041 0x410041 0031fca4 00410041 00410041 00410041 00410041 0x410041 0031fca8 00410041 00410041 00410041 00410041 0x410041 0031fcac 00410041 00410041 00410041 00410041 0x410041 0031fcb0 00410041 00410041 00410041 00410041 0x410041 0031fcb4 00410041 00410041 00410041 00410041 0x410041 0031fcb8 00410041 00410041 00410041 00410041 0x410041 0031fcbc 00410041 00410041 00410041 00410041 0x410041 0031fcc0 00410041 00410041 00410041 00410041 0x410041 0031fcc4 00410041 00410041 00410041 00410041 0x410041 0031fcc8 00410041 00410041 00410041 00410041 0x410041 0031fccc 00410041 00410041 00410041 00410041 0x410041 0031fcd0 00410041 00410041 00410041 00410041 0x410041 0031fcd4 00410041 00410041 00410041 00410041 0x410041 0031fcd8 00410041 00410041 00410041 00410041 0x410041 0031fcdc 00410041 00410041 00410041 00410041 0x410041 0031fce0 00410041 00410041 00410041 00410041 0x410041 0031fce4 00410041 00410041 00410041 00410041 0x410041 0031fce8 00410041 00410041 00410041 00410041 0x410041 0031fcec 00410041 00410041 00410041 00410041 0x410041 0031fcf0 00410041 00410041 00410041 00410041 0x410041 0031fcf4 00410041 00410041 00410041 00410041 0x410041 0031fcf8 00410041 00410041 00410041 00410041 0x410041 0031fcfc 00410041 00410041 00410041 00410041 0x410041 0031fd00 00410041 00410041 00410041 00410041 0x410041 0031fd04 00410041 00410041 00410041 00410041 0x410041 0031fd08 00410041 00410041 00410041 00410041 0x410041 0031fd0c 00410041 00410041 00410041 00410041 0x410041 0031fd10 00410041 00410041 00410041 00410041 0x410041 0031fd14 00410041 00410041 00410041 00410041 0x410041 0031fd18 00410041 00410041 00410041 00410041 0x410041 0031fd1c 00410041 00410041 00410041 00410041 0x410041 0031fd20 00410041 00410041 00410041 00410041 0x410041 0031fd24 00410041 00410041 00410041 00410041 0x410041 0031fd28 00410041 00410041 00410041 00410041 0x410041 0031fd2c 00410041 00410041 00410041 00410041 0x410041 0031fd30 00410041 00410041 00410041 00410041 0x410041 0031fd34 00410041 00410041 00410041 00410041 0x410041 0031fd38 00410041 00410041 00410041 00410041 0x410041 0031fd3c 00410041 00410041 00410041 00410041 0x410041 0031fd40 00410041 00410041 00410041 00410041 0x410041 0031fd44 00410041 00410041 00410041 00410041 0x410041 0031fd48 00410041 00410041 00410041 00410041 0x410041 0031fd4c 00410041 00410041 00410041 00410041 0x410041 0031fd50 00410041 00410041 00410041 00410041 0x410041 0031fd54 00410041 00410041 00410041 00410041 0x410041 0031fd58 00410041 00410041 00410041 00410041 0x410041 0031fd5c 00410041 00410041 00410041 00410041 0x410041 0031fd60 00410041 00410041 00410041 00410041 0x410041 0031fd64 00410041 00410041 00410041 00410041 0x410041 0031fd68 00410041 00410041 00410041 00410041 0x410041 0031fd6c 00410041 00410041 00410041 00410041 0x410041 0031fd70 00410041 00410041 00410041 00410041 0x410041 0031fd74 00410041 00410041 00410041 00410041 0x410041 0031fd78 00410041 00410041 00410041 00410041 0x410041 0031fd7c 00410041 00410041 00410041 00410041 0x410041 0031fd80 00410041 00410041 00410041 00410041 0x410041 0031fd84 00410041 00410041 00410041 00410041 0x410041 0031fd88 00410041 00410041 00410041 00410041 0x410041 0031fd8c 00410041 00410041 00410041 00410041 0x410041 0031fd90 00410041 00410041 00410041 00410041 0x410041 0031fd94 00410041 00410041 00410041 00410041 0x410041 0031fd98 00410041 00410041 00410041 00410041 0x410041 PRIMARY_PROBLEM_CLASS: STACK_CORRUPTION FOLLOWUP_IP: image00a20000+56b3 00a256b3 66890c02 mov word ptr [edx+eax],cx SYMBOL_STACK_INDEX: 0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: image00a20000 IMAGE_NAME: image00a20000 SYMBOL_NAME: image00a20000+56b3 STACK_COMMAND: ~0s ; kb BUCKET_ID: WRONG_SYMBOLS Followup: MachineOwner --------- 0:000> lmvm image00a20000 start end module name 00a20000 00bd2000 image00a20000 (no symbols) Loaded symbol image file: C:Program FilesLenovoSystem Updatemapdrv.exe Image path: image00a20000 Image name: image00a20000 Timestamp: Wed Jun 21 23:36:40 2017 (594B6578) CheckSum: 001BA113 ImageSize: 001B2000 File version: 1.0.0.1 Product version: 1.0.0.1 File flags: 0 (Mask 3F) File OS: 4 Unknown Win32 File type: 1.0 App File date: 00000000.00000000 Translations: 0409.04b0 ProductName: Map Network Drive InternalName: mapdrv OriginalFilename: mapdrv.exe ProductVersion: 1, 0, 0, 1 FileVersion: 1, 0, 0, 1 FileDescription: Map Network Drive Application LegalCopyright: Copyright Lenovo 2005, 2006, all rights reserved. Copyright IBM Corporation 1996-2005, all rights reserved. Solution - Fix & Patch: ======================= Update Lenovo System Update to version 5.07.0072 or later. You can determine the currently installed version by opening Lenovo System Update, clicking on the green question mark in the top right corner and then selecting aAbout.a Lenovo System Update can be updated by choosing either of the following methods: Lenovo System Update automatically checks for a later version whenever the application is run. Click OK when prompted that a new version is available. To manually update, download the latest version from the following URL: https://support.lenovo.com/en/documents/ht080136 Security Risk: ============== The security risk of the buffer overflow and arbitrary code execution vulnerability is estimated as high. Credits & Authors: ================== S.AbenMassaoud - https://www.vulnerability-lab.com/show.php?user=S.AbenMassaoud Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. Domains: www.vulnerability-lab.com www.vuln-lab.com www.vulnerability-db.com Services: magazine.vulnerability-lab.com paste.vulnerability-db.com infosec.vulnerability-db.com Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php vulnerability-lab.com/rss/rss_upcoming.php vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php vulnerability-lab.com/register.php vulnerability-lab.com/list-of-bug-bounty-programs.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@ or research@) to get a ask permission. Copyright A(c) 2018 | Vulnerability Laboratory - [Evolution Security GmbH]aC/ -- VULNERABILITY LABORATORY - RESEARCH TEAM SERVICE: www.vulnerability-lab.com