Exploit-DB #15407
Description: Avira Premium Security Suite - 'NtCreateKey' Race Condition
Type: dos
Platform: windows
Date: 2010-11-03
Author: Nikita Tarakanov

Exploit:
1.Description:

The avipbb.sys kernel driver distributed with Avira Premium Security Suite
contains a race condition vulnerability in the handling paramaters of
NtCreatekey function.
Exploitation of this issue allows an attacker to crash system(make infamous
BSoD) or gain escalated priviligies.
An attacker would need local access to a vulnerable computer to exploit this
vulnerability.


Affected application: Avira Premium Security Suite, up to date version
10.0.0.565.
Affected file: avipbb.sys version 10.0.8.11.

2.Crash dump info:
kd> !analyze -v
*******************************************************************************
*
*
*                        Bugcheck
Analysis                                    *
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by
try-except,
it must be protected by a Probe.  Typically the address is just plain bad or
it
is pointing at freed memory.
Arguments:
Arg1: 90909090, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 80536c53, If non-zero, the instruction address which referenced the
bad memory
    address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


READ_ADDRESS:  90909090

FAULTING_IP:
nt!memmove+33
80536c53 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]

MM_INTERNAL_CODE:  0

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  hookfuzz.exe

TRAP_FRAME:  f0711bec -- (.trap 0xfffffffff0711bec)
ErrCode = 00000000
eax=9090912a ebx=e1297088 ecx=00000026 edx=00000002 esi=90909090
edi=e1297088
eip=80536c53 esp=f0711c60 ebp=f0711c68 iopl=0         nv up ei pl nz ac pe
nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000
efl=00010216
nt!memmove+0x33:
80536c53 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
Resetting default scope

LAST_CONTROL_TRANSFER:  from 804f7b9d to 80527bdc

STACK_TEXT:
f0711728 804f7b9d [PII_REDACTED] 00000000
nt!RtlpBreakWithStatusInstruction
f0711774 804f878a [PII_REDACTED] c0484848 nt!KiBugCheckDebugBreak+0x19
f0711b54 804f8cb5 [PII_REDACTED] 00000000 nt!KeBugCheck2+0x574
f0711b74 8051cc4f [PII_REDACTED] 00000000 nt!KeBugCheckEx+0x1b
f0711bd4 8054051c [PII_REDACTED] 00000000 nt!MmAccessFault+0x8e7
f0711bd4 80536c53 [PII_REDACTED] 00000000 nt!KiTrap0E+0xcc
f0711c68 80528107 e[PII_REDACTED]9[PII_REDACTED]a nt!memmove+0x33
f0711c88 f105f0c7 e[PII_REDACTED]009a 01762aec
nt!RtlAppendUnicodeStringToString+0x45
WARNING: Stack unwind information not available. Following frames may be
wrong.
f0711cd8 f105f4d3 00[PII_REDACTED]fea0 f0711d08 avipbb+0x80c7
f0711d40 8053d638 0012fea8 00[PII_REDACTED]feb0 avipbb+0x84d3
f0711d40 7c90e4f4 0012fea8 00[PII_REDACTED]feb0 nt!KiFastCallEntry+0xf8
0012fe60 7c90d0dc 00[PII_REDACTED]fea8 00020019 ntdll!KiFastSystemCallRet
0012fe64 00[PII_REDACTED]fea8 00[PII_REDACTED]feb0 ntdll!ZwCreateKey+0xc
0012ff70 0040158f 00[PII_REDACTED]2e28 00342e58 hookfuzz!wmain+0x100
0012ffc0 7c817067 bc27f626 01cb7b6b 7ffdf000
hookfuzz!__tmainCRTStartup+0x15e
0012fff0 00[PII_REDACTED]15e6 [PII_REDACTED] kernel32!BaseProcessStart+0x23


STACK_COMMAND:  kb

FOLLOWUP_IP:
avipbb+80c7
f105f0c7 3bc6            cmp     eax,esi

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  avipbb+80c7

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: avipbb

IMAGE_NAME:  avipbb.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4bfe7d8e

FAILURE_BUCKET_ID:  0x50_avipbb+80c7

BUCKET_ID:  0x50_avipbb+80c7

Followup: MachineOwner
---------

3.Proof of concept is in poc.zip file.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15407.zip (poc.zip)