Exploit-DB #11786
Description: Virtual PC Hypervisor - Memory Protection
Type: local
Platform: windows
Date: 2010-03-17
Author: Core Security

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

      Core Security Technologies - CoreLabs Advisory
           http://www.coresecurity.com/corelabs/

   Virtual PC Hypervisor Memory Protection Vulnerability



1. *Advisory Information*

Title: Virtual PC Hypervisor Memory Protection Vulnerability
Advisory Id: CORE-2009-0803
Advisory URL:
http://www.coresecurity.com/content/virtual-pc-2007-hypervisor-memory-protection-bug
Date published: 2010-03-16
Date of last update: 2010-03-16
Vendors contacted: Microsoft
Release mode: User release



2. *Vulnerability Information*

Class: Improper Access Control [CWE-285]
Impact: Security bypass
Remotely Exploitable: No
Locally Exploitable: Yes
Bugtraq ID: 38764
CVE Name: N/A



3. *Vulnerability Description*

Windows Virtual PC and Microsoft Virtual PC 2007 are system
virtualization desktop applications from Microsoft used to run one or
many virtual hosts on a single physical system. Windows 7 relies on
Virtual PC technology to implement the backward compatibility XP Mode
for legacy Windows applications. Using XP Mode, Windows 7 users can run
Windows applications on a virtualized Windows XP SP3 operating system
directly from the Windows 7 desktop but in doing so they may be
inadvertently increasing their risk due to a bug that makes standard
Windows anti-exploitation mechanisms ineffective.

A vulnerability found in the memory management of the Virtual Machine
Monitor makes memory pages mapped above the 2GB available with read or
read/write access to user-space programs running in a Guest operating
system. By leveraging this vulnerability it is possible to bypass
security mechanisms of the operating system such as Data Execution
Prevention (DEP) [1], Safe Structured Error Handling (SafeSEH) [2] and
Address Space Layout Randomization (ASLR) [3] designed to prevent
exploitation of security bugs in applications running on Windows
operation systems.

Thus applications with bugs that are not exploitable when running in
non-virtualized operating systems become exploitable if running within a
guest OS of Virtual PC. In particular, an application running on Windows
7 in XP Mode may be exploitable while the same application running
directly on a Windows XP SP3 system is not.

Additionally, software bugs that normally may not be considered
security-relevant and therefore not prioritized for the development or
deployment of fixes may suddenly become unpatched and exploitable
security bugs in the context of this vulnerability.

The vulnerability can be exploited locally within a virtualized system
to escalate privileges or remotely for code execution in combination
with any client-side bug for which existing patches have not been
applied or with any client-side bug for which a fix has not been
developed after dismissing the bug as not exploitable or of low
priority. The vulnerability does not seem usable to escape from a
virtualized OS (guest) to execute code in the context of the
non-virtualized OS (host). Use of the vulnerability to implement covert
inter-process communications within the virtualized OS or to establish
inter-VM communication have not been researched in full but are deemed
possible.


4. *Vulnerable packages*

   . Virtual PC 2007
   . Virtual PC 2007 SP1
   . Windows Virtual PC
   . Virtual Server 2005
   . Virtual Server 2005 R2 SP1


5. *Non-vulnerable packages*

   . Microsoft virtualization products that are based on Hyper-V technology.


6. *Vendor Information, Solutions and Workarounds*

This issue was reported to Microsoft in August 2009. The vendor has
acknowledged the report and after extensive analysis indicated that it
plans to solve the problem in future updates to the associated products.

We recommend affected users to run all mission critical Windows
applications on non-virtualized systems or to use virtualization
technologies that aren't affected by this bug. Windows operating systems
and applications that must run virtualized using Virtual PC technologies
should be kept at the highest patch level possible and monitored to
detect exploitation attempts.


7. *Credits*

This vulnerability was discovered by Nicolas Economou from Core Security
Technologies. Technical analysis and proof-of-concept tools were
developed by Nicolas Economou and Diego Juarez from Core's Exploit
Writers Team.


8. *Technical Description / Proof of Concept Code*

Operating systems based on Microsoft Windows NT technologies provide a
flat 32-bit virtual address space that describes 4 gigabytes of virtual
memory to 32-bit processes. This address space is used by the process to
map its executable code and the data that it uses during its runtime.
For performance and efficiency reasons the process address space is
usually split so that 2 GB of address space are directly accessible by
the user-mode application process and the other 2 GB are used to map the
code and data of the operating system and only accessible to kernel code
[4]. Any attempts from a user-space process to dereference and use
memory contents mapped at addresses above the 2GB boundary will trigger
an exception and terminate the offending process.

In some versions of 32-bit Windows operating systems it is possible to
configure the OS to provide applications with a 3GB flat virtual address
space but nonetheless the remaining portion is not accessible to
user-mode processes.

In Microsoft Virtual PC and Windows Virtual PC, the Virtual Machine
Monitor (VMM) is responsible for mediating access to hardware resources
and devices from operating systems running in a virtualized environment.
The transparency and efficiency of this mediation layer is one of the
core characteristics of modern virtualization technologies. In this
context, to maintain an equivalent level of risk for the same
application independently of whether it is running on a virtualized or a
non