------------------------------------------------------------------------ .NET Framework EncoderParameter integer overflow vulnerability ------------------------------------------------------------------------ Yorick Koster, September 2011 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ An integer overflow vulnerability has been discovered in the EncoderParameter class of the .NET Framework. Exploiting this vulnerability results in an overflown integer that is used to allocate a buffer on the heap. After the incorrect allocation, one or more user-supplied buffers are copied in the new buffer, resulting in a corruption of the heap. By exploiting this vulnerability, it is possible for an application running with Partial Trust permissions to to break from the CLR sandbox and run arbitrary code with Full Trust permissions. ------------------------------------------------------------------------ Affected versions ------------------------------------------------------------------------ It has been verified that this vulnerability exists in the .NET Framework versions 2.0, 3.0, 3.5 & 4. Earlier versions of the .NET Framework may or may not be vulnerable as well as the affected class is also available the .NET Framework versions 1.0 & 1.1. ------------------------------------------------------------------------ See also ------------------------------------------------------------------------ - MS12-025 [2]: Vulnerability in .NET Framework Could Allow Remote Code Execution (2671605) - KB2671605 [3] MS12-025: Vulnerabilities in the .NET Framework could allow remote code execution: April 10, 2012 - SSD: [4] SecuriTeam Secure Disclosure program - MS12-025 [5]: IKVM.NET Weblog ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ This issue was resolved with the release of MS12-025 [6]. It appears the fix was part of a security push for System.Drawing.dll. ------------------------------------------------------------------------ Introduction ------------------------------------------------------------------------ The EncoderParameter class (System.Drawing.Imaging.EncoderParameter [7]) is used to pass a value, or an array of values, to an image encoder (GDI+). An image encoder can be used to translate an Image or Bitmap object to a particular file format, for example GIF, JPEG or PNG. EncoderParameter is implemented in the System.Drawing.dll Assembly, which is located in the Global Assembly Cache [8] (GAC). Consequently, the Assembly is trusted by the .NET Framework and therefore this Assembly will run with Full Trust permissions. In addition, the Assembly is compiled with the AllowPartiallyTrustedCallers [9] attribute, which allows it to be called from Assemblies running with Partial Trust permissions. ------------------------------------------------------------------------ Integer overflow ------------------------------------------------------------------------ The EncoderParameter class contains various constructor methods. All of these constructors allocate memory on the heap. The size of the allocated buffer depends on the constructor's parameters. After allocation, the values of these constructor parameters are copied into the new buffer. For example the constructor EncoderParameter(Encoder, Int64) accepts a 64-bit (8-byte) long value, thus 8 bytes are allocated on the heap after which the value of the long parameter is copied into this heap buffer. The heap buffer is freed by calling the Dispose() method. This method is also called when the EncoderParameter object is destroyed. Some constructor methods accept one or more arrays. For these methods, the number of allocated bytes is the size of one array member multiplied by the number of members in the array. These methods do not check whether the resulting integer value (used for heap allocation) overflows. In some cases it is possible to trigger an integer overflow resulting in the allocation of a buffer that is too small for the supplied constructor parameters. Not all methods are exploitable as an overly long array is required to trigger an integer overflow. The .NET Framework limits the number of array members. One constructor method (EncoderParameter(Encoder, Int32[], Int32[], Int32[], Int32[])) appears to be very suitable for exploiting this vulnerability. The implementation of this method is listed below. public EncoderParameter(Encoder encoder, int[] numerator1, int[] denominator1, int[] numerator2, int[] denominator2) { this.parameterGuid = encoder.Guid; if (numerator1.Length != denominator1.Length || numerator1.Length != denominator2.Length || denominator1.Length != denominator2.Length) { throw SafeNativeMethods.Gdip.StatusException(2); } else { this.parameterValueType = 8; this.numberOfValues = numerator1.Length; int num = Marshal.SizeOf(typeof (int)); this.parameterValue = Marshal.AllocHGlobal(this.numberOfValues * 4 * num); if (this.parameterValue == IntPtr.Zero) { throw SafeNativeMethods.Gdip.StatusException(3); } else { for (int index = 0; index < this.numberOfValues; ++index) { Marshal.WriteInt32(EncoderParameter.Add(this.parameterValue, 4 * index * num), numerator1[index]); Marshal.WriteInt32(EncoderParameter.Add(this.parameterValue, (4 * index + 1) * num), denominator1[index]); Marshal.WriteInt32(EncoderParameter.Add(this.parameterValue, (4 * index + 2) * num), numerator2[index]); Marshal.WriteInt32(EncoderParameter.Add(this.parameterValue, (4 * index + 3) * num), denominator2[index]); } GC.KeepAlive((object) this); } } } This constructor method is interesting for two reasons. First of all, the method accepts four integer arrays. The number of bytes that will be allocated is the number of members in the numerator1 array multiplied by 16 (four times the size of a 32-bit integer). Supplying an array containing 268,435,456 integer values is enough to trigger the overflow. Doing so results in the allocation of a 0-byte buffer. The following proof of concept code can be used to trigger this vulnerability: using System; using System.Drawing.Imaging; namespace EncoderParameterCrash { static class Crash { [STAThread] static void Main() { int[] largeArray = new int[0x10000000]; EncoderParameter crash = new EncoderParameter(Encoder.Quality, largeArray, largeArray, largeArray, largeArray); } } } Running this code will cause the application to crash as it tries to write beyond a heap boundary: The program '[2696] EncoderParameterCrash.vshost.exe: Managed' has exited with code -1073741819 (0xc0000005). As demonstrated in the proof of concept, copying four large integer arrays into a heap buffer causes the program to crash. The proof of concept will try to write 4GB of data onto the heap. Since heap segments are a lot smaller than that, copying this amount of data will fail early in the process. This will cause Windows to terminate the program. All constructor methods that handle two or more arrays always check if all supplied arrays are of the same length. As such, in order to trigger the integer overflow arrays must at least contain 268,435,456 members. This makes exploitation of this issue difficult. However, the listed constructor method contains a programming mistake. When validating the length of the supplied arrays, the method fails to check the length of the numerator2 parameter. Instead it checks numerator1 twice. The correct check should be numerator2.Length != denominator2.Length instead of numerator1.Length != denominator2.Length. This is the second reason why this method is interesting - from an attacker's point of view. Due to the missing check, it is possible to use the numerator2 parameter to control how much data is copied into the heap buffer. Supplying a small(er) array as numerator2 parameter will cause an IndexOutOfRangeException exception to be thrown; prematurely ending the while loop. Since the exception is thrown by the .NET Framework, this exception can be handled by the application thus preventing the application from crashing. Both ingredients provide for an exploitable heap corruption as attackers control how much data is allocated on the heap and also how much data is copied into the allocated buffer. It was possible to successfully exploit this issue on the following Windows versions: - Windows XP Professional SP3 32-bit (with 4GB RAM) - Windows Vista Home Premium SP2 32-bit - Windows Vista Business SP2 32-bit and 64-bit - Windows 7 Home Premium SP1 64-bit - Windows 7 Professional SP1 64-bit - Windows 7 Enterprise SP1 32-bit and 64-bit By exploiting this vulnerability, it is possible for an application running with Partial Trust permissions to to break from the CLR sandbox [10] (CAS) and run arbitrary code with Full Trust permissions. Examples of Partial Trusted applications include, ClickOnce, XAML Browser Applications (XBAP), ASP.NET (eg, shared hosting) & SilverLight. It must be noted that the affected class is not available for SilverLight applications. ------------------------------------------------------------------------ Limitations ------------------------------------------------------------------------ As noted above, this issue cannot be exploited using a SilverLight application. With the release of MS11-044 [11], Microsoft changed the way ClickOnce & XBAP applications are started. In particular, whenever such an application is started from the Internet security zone, a dialog is always shown even if the application does not request elevated permissions. Previously the application would just start. See also: http://blogs.msdn.com/b/clrteam/archive/2011/06/06/changes-coming-to-clickonce-applications-running-in-the-internet-zone.aspx (It is possible to display a green icon in the dialog by code signing the manifests. When the manifests aren't signed, a red icon is displayed). The dialog is not shown for applications launched from the intranet security zone. In this case the application will start immediately - as long as it does not request elevated permissions. The intranet zone is only available when it has been enabled on the target system. This is common for corporate networks, but less common for home users. Finally, with the release of Internet Explorer 9 Microsoft chose to disable XBAP applications in the Internet security zone. See also: http://blogs.msdn.com/b/ieinternals/archive/2011/03/09/internet-explorer-9-xbap-disabled-in-the-internet-zone.aspx ------------------------------------------------------------------------ Windows XP ------------------------------------------------------------------------ A special note must be made for Windows XP. It seems that Windows XP is a bit picky when handling large arrays. In a lot of cases, OutOfMemoryException exceptions will be thrown when trying to exploit this issue. Successful exploitation has been achieved on a 32-bit Windows XP system with 4GB of RAM. ------------------------------------------------------------------------ References ------------------------------------------------------------------------ [1] http://www.akitasecurity.nl/advisory.html?id=AK20110801 [2] http://technet.microsoft.com/en-us/security/bulletin/ms12-025 [3] http://support.microsoft.com/kb/2671605 [4] http://www.beyondsecurity.com/ssd.html [5] http://weblog.ikvm.net/PermaLink.aspx?guid=b3525cd1-8788-4d6d-b299-4722ddebad94 [6] http://technet.microsoft.com/en-us/security/bulletin/ms12-025 [7] http://msdn.microsoft.com/en-us/library/system.drawing.imaging.encoderparameter.aspx [8] http://msdn.microsoft.com/en-us/library/yf1d93sz%28v=VS.100%29.aspx [9] http://msdn.microsoft.com/en-us/library/system.security.allowpartiallytrustedcallersattribute.aspx [10] http://msdn.microsoft.com/en-us/magazine/ee677170.aspx [11] http://technet.microsoft.com/en-us/security/bulletin/ms11-044 ------------------------------------------------------------------------ -- ------------------------------------------------------------------------ Akita Software Security (Kvk 37144957) http://www.akitasecurity.nl/ ------------------------------------------------------------------------ Key fingerprint = 5FC0 F50C 8B3A 4A61 7A1F 2BFF 5482 D26E D890 5A65 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5482D26ED8905A65