Exploit-DB #47486
Description: Microsoft Windows Kernel - Out-of-Bounds Read in CI!CipFixImageType While Parsing Malformed PE File
Type: dos
Platform: windows
Date: 2019-10-10
Author: Google Security Research

Exploit:
We have encountered a Windows kernel crash in CI!CipFixImageType while trying to load a malformed PE image into the process address space as a data file (i.e. LoadLibraryEx(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE)). An example crash log generated after triggering the bug is shown below:

--- cut ---
*** Fatal System Error: 0x00000050
                       (0xFFFFF8007B6E00AC,0x[PII_REDACTED]000000,0xFFFFF80079A7E5C1,0x[PII_REDACTED]000000)

Driver at fault: 
***        CI.dll - Address FFFFF80079A7E5C1 base at FFFFF80079A30000, DateStamp 8581dc0d
.
Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

[...]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffff8007b6e00ac, memory referenced.
Arg2: [PII_REDACTED], value 0 = read operation, 1 = write operation.
Arg3: fffff80079a7e5c1, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: [PII_REDACTED], (reserved)

[...]

TRAP_FRAME:  fffffa8375df1860 -- (.trap 0xfffffa8375df1860)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=[PII_REDACTED] rbx=[PII_REDACTED] rcx=[PII_REDACTED]
rdx=[PII_REDACTED] rsi=[PII_REDACTED] rdi=[PII_REDACTED]
rip=fffff80079a7e5c1 rsp=fffffa8375df19f0 rbp=fffffa8375df1b30
 r8=[PII_REDACTED]0000c0  r9=fffff8007b6d0080 r10=[PII_REDACTED]
r11=fffff8007b6e0070 r12=[PII_REDACTED] r13=[PII_REDACTED]
r14=[PII_REDACTED] r15=[PII_REDACTED]
iopl=0         nv up ei ng nz ac po cy
CI!CipFixImageType+0x9d:
fffff800`79a7e5c1 418b44cb3c      mov     eax,dword ptr [r11+rcx*8+3Ch] ds:fffff800`7b6e00ac=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80077ea6642 to fffff80077dc46a0

STACK_TEXT:  
fffffa83`75df0e18 fffff800`77ea6642 : fffff800`7b6e00ac 00000000`00000003 fffffa83`75df0f80 fffff800`77d22be0 : nt!DbgBreakPointWithStatus
fffffa83`75df0e20 fffff800`77ea5d32 : fffff800`00000003 fffffa83`75df0f80 fffff800`77dd0fb0 fffffa83`75df14c0 : nt!KiBugCheckDebugBreak+0x12
fffffa83`75df0e80 fffff800`77dbca07 : ffff8ac5`62b15f80 fffff800`77ed0[PII_REDACTED]0`00000000 fffff800`78063900 : nt!KeBugCheck2+0x952
fffffa83`75df1580 fffff800`77de0161 : 00000000`00000050 fffff800`7b6e00ac 00000000`00000000 fffffa83`75df1860 : nt!KeBugCheckEx+0x107
fffffa83`75df15c0 fffff800`77c7aaef : 00000000`[PII_REDACTED]`[PII_REDACTED]`00000000 fffff800`7b6e00ac : nt!MiSystemFault+0x1d3171
fffffa83`75df16c0 fffff800`77dca920 : fffff800`7b6d0[PII_REDACTED]0`00000000 ffffe687`5031c[PII_REDACTED]0`00000000 : nt!MmAccessFault+0x34f
fffffa83`75df1860 fffff800`79a7e5c1 : ffffe687`4f6b1080 fffff800`7b6d0[PII_REDACTED]0`00000000 fffff800`79a67280 : nt!KiPageFault+0x360
fffffa83`75df19f0 fffff800`79a7c879 : fffffa83`75df1cd0 00000000`[PII_REDACTED]`c00000bb 00000000`00000000 : CI!CipFixImageType+0x9d
fffffa83`75df1a30 fffff800`78285766 : fffffa83`75df1c70 fffff800`7b6d0[PII_REDACTED]0`0000000e fffff800`7b6d0000 : CI!CiValidateImageHeader+0x279
fffffa83`75df1bb0 fffff800`7828528a : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00011000 : nt!SeValidateImageHeader+0xd6
fffffa83`75df1c60 fffff800`7821e0da : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : nt!MiValidateSectionCreate+0x436
fffffa83`75df1e50 fffff800`781fc861 : fffffa83`75df2180 fffffa83`75df1fb0 00000000`40000000 fffffa83`75df2180 : nt!MiValidateSectionSigningPolicy+0xa6
fffffa83`75df1eb0 fffff800`781dca20 : ffffe687`5031c180 fffffa83`75df2180 fffffa83`75df2180 ffffe687`5031c150 : nt!MiCreateNewSection+0x5ad
fffffa83`75df2010 fffff800`781dcd24 : fffffa83`75df2040 ffffd483`86519790 ffffe687`5031c[PII_REDACTED]0`00000000 : nt!MiCreateImageOrDataSection+0x2d0
fffffa83`75df2100 fffff800`781dc37f : 00000000`11000000 fffffa83`75df24c0 00000000`[PII_REDACTED]`00000002 : nt!MiCreateSection+0xf4
fffffa83`75df2280 fffff800`781dc110 : 000000bc`f7c78[PII_REDACTED]0`[PII_REDACTED]`[PII_REDACTED]`00000001 : nt!MiCreateSectionCommon+0x1ff
fffffa83`75df2360 fffff800`77dce115 : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : nt!NtCreateSection+0x60
fffffa83`75df23d0 00007ffe`5771c9a4 : 00007ffe`54641ae7 00000000`[PII_REDACTED]`00000001 40b28496`f324e4f9 : nt!KiSystemServiceCopyEnd+0x25
000000bc`f7c788b8 00007ffe`54641ae7 : 00000000`[PII_REDACTED]`00000001 40b28496`f324e4f9 feafc9c1`1796ffa1 : ntdll!NtCreateSection+0x14
000000bc`f7c788c0 00007ffe`54645640 : 00000203`34a8b3d0 00000007`00[PII_REDACTED]7ffe`56d32[PII_REDACTED]0`00000022 : KERNELBASE!BasepLoadLibraryAsDataFileInternal+0x2e7
000000bc`f7c78af0 00007ffe`5462c41d : 00000203`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : KERNELBASE!LoadLibraryExW+0xe0
000000bc`f7c78b60 00007ffe`559f03d1 : 00000203`34a79[PII_REDACTED]0`[PII_REDACTED]`34a96190 00007ffe`55a06d85 : KERNELBASE!GetFileVersionInfoSizeExW+0x3d
000000bc`f7c78bc0 00007ffe`559f035c : 00000000`00[PII_REDACTED]7ffe`549f10ff 00000203`34a79130 000000bc`f7c78f10 : shell32!_LoadVersionInfo+0x39
000000bc`f7c78c30 00007ffe`54a6c1c1 : 00000000`[PII_REDACTED]`00000000 ffffffff`fffffffe 00000000`00000000 : shell32!CVersionPropertyStore::Initialize+0x2c

[...]
--- cut ---

The direct cause of the crash is an attempt to read fr