Exploit-DB #47488
Description: Microsoft Windows Kernel - Out-of-Bounds Read in CI!HashKComputeFirstPageHash While Parsing Malformed PE File
Type: dos
Platform: windows
Date: 2019-10-10
Author: Google Security Research

Exploit:
We have encountered a Windows kernel crash in CI!HashKComputeFirstPageHash while trying to load a malformed PE image into the process address space as a data file (i.e. LoadLibraryEx(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE)). An example crash log generated after triggering the bug is shown below:

--- cut ---
*** Fatal System Error: 0x00000050
                       (0xFFFFF80068F02000,0x[PII_REDACTED]000000,0xFFFFF80067291A2C,0x[PII_REDACTED]000000)

Driver at fault: 
***        CI.dll - Address FFFFF80067291A2C base at FFFFF[PII_REDACTED]0, DateStamp 8581dc0d
.
Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

[...]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffff80068f02000, memory referenced.
Arg2: [PII_REDACTED], value 0 = read operation, 1 = write operation.
Arg3: fffff80067291a2c, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: [PII_REDACTED], (reserved)

[...]

TRAP_FRAME:  ffffe20f4b7d6400 -- (.trap 0xffffe20f4b7d6400)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=[PII_REDACTED]0000c8 rbx=[PII_REDACTED] rcx=144670b8d60e0000
rdx=[PII_REDACTED] rsi=[PII_REDACTED] rdi=[PII_REDACTED]
rip=fffff80067291a2c rsp=ffffe20f4b7d6590 rbp=ffffe20f4b7d6690
 r8=00000000fffffe00  r9=fffff80068ef0000 r10=[PII_REDACTED]
r11=ffffe20f4b7d6760 r12=[PII_REDACTED] r13=[PII_REDACTED]
r14=[PII_REDACTED] r15=[PII_REDACTED]
iopl=0         nv up ei pl nz na pe nc
CI!HashKComputeFirstPageHash+0x1f4:
fffff800`67291a2c 418b5dd4        mov     ebx,dword ptr [r13-2Ch] ds:ffffffff`ffffffd4=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80065aa6642 to fffff800659c46a0

STACK_TEXT:  
ffffe20f`4b7d59b8 fffff800`65aa6642 : fffff800`68f02[PII_REDACTED]0`00000003 ffffe20f`4b7d5b20 fffff800`65922be0 : nt!DbgBreakPointWithStatus
ffffe20f`4b7d59c0 fffff800`65aa5d32 : fffff800`00000003 ffffe20f`4b7d5b20 fffff800`659d0fb0 ffffe20f`4b7d6060 : nt!KiBugCheckDebugBreak+0x12
ffffe20f`4b7d5a20 fffff800`659bca07 : ffff8bc5`e2f17f80 fffff800`65ad0[PII_REDACTED]0`00000000 fffff800`65c63900 : nt!KeBugCheck2+0x952
ffffe20f`4b7d6120 fffff800`659e0161 : 00000000`00000050 fffff800`68f02[PII_REDACTED]0`00000000 ffffe20f`4b7d6400 : nt!KeBugCheckEx+0x107
ffffe20f`4b7d6160 fffff800`6587aaef : fffffb00`023b21b0 00000000`[PII_REDACTED]`00000000 fffff800`68f02000 : nt!MiSystemFault+0x1d3171
ffffe20f`4b7d6260 fffff800`659ca920 : ffffe20f`4b7d6[PII_REDACTED]0`[PII_REDACTED]`00000200 fffff800`65c651c0 : nt!MmAccessFault+0x34f
ffffe20f`4b7d6400 fffff800`67291a2c : 00000000`00000000 ffffe20f`4b7d6[PII_REDACTED]0`[PII_REDACTED]`00001000 : nt!KiPageFault+0x360
ffffe20f`4b7d6590 fffff800`67280829 : 00000000`00000000 ffffce0d`8ae71003 ffffac8f`23a2a9e8 00000000`00000000 : CI!HashKComputeFirstPageHash+0x1f4
ffffe20f`4b7d67c0 fffff800`6727f10d : ffffac8f`23a2a5a0 ffffce0d`8ae71080 ffffce0d`[PII_REDACTED]`00000000 : CI!CipGetEmbeddedSignatureAndFindFirstMatch+0x181
ffffe20f`4b7d6860 fffff800`6727e89a : ffffac8f`23a2a5a0 ffffce0d`8b7e1d50 ffffce0d`8ae71080 fffff800`68ef0000 : CI!CipValidatePageHash+0xfd
ffffe20f`4b7d6950 fffff800`6727cc8b : fffff800`6727f010 ffffe20f`4b7d6c8c ffffce0d`8b7e1d50 ffffce0d`8ae71080 : CI!CipValidateImageHash+0xe6
ffffe20f`4b7d6a30 fffff800`65e85766 : ffffe20f`4b7d6c70 fffff800`68ef0[PII_REDACTED]0`0000000e fffff800`68ef0000 : CI!CiValidateImageHeader+0x68b
ffffe20f`4b7d6bb0 fffff800`65e8528a : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00012000 : nt!SeValidateImageHeader+0xd6
ffffe20f`4b7d6c60 fffff800`65e1e0da : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : nt!MiValidateSectionCreate+0x436
ffffe20f`4b7d6e50 fffff800`65dfc861 : ffffe20f`4b7d7180 ffffe20f`4b7d6fb0 00000000`40000000 ffffe20f`4b7d7180 : nt!MiValidateSectionSigningPolicy+0xa6
ffffe20f`4b7d6eb0 fffff800`65ddca20 : ffffce0d`8b7e1d50 ffffe20f`4b7d7180 ffffe20f`4b7d7180 ffffce0d`8b7e1d20 : nt!MiCreateNewSection+0x5ad
ffffe20f`4b7d7010 fffff800`65ddcd24 : ffffe20f`4b7d7040 ffffac8f`2af6a9f0 ffffce0d`8b7e1d50 00000000`00000000 : nt!MiCreateImageOrDataSection+0x2d0
ffffe20f`4b7d7100 fffff800`65ddc37f : 00000000`11000000 ffffe20f`4b7d74c0 00000000`[PII_REDACTED]`00000002 : nt!MiCreateSection+0xf4
ffffe20f`4b7d7280 fffff800`65ddc110 : 00000010`0e3f8dc8 00000000`[PII_REDACTED]`[PII_REDACTED]`00000001 : nt!MiCreateSectionCommon+0x1ff
ffffe20f`4b7d7360 fffff800`659ce115 : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : nt!NtCreateSection+0x60
ffffe20f`4b7d73d0 00007ffe`c317c9a4 : 00007ffe`c0511ae7 00000000`[PII_REDACTED]`00000001 40b28496`f324e4f9 : nt!KiSystemServiceCopyEnd+0x25
00000010`0e3f8d58 00007ffe`c0511ae7 : 00000000`[PII_REDACTED]`00000001 40b28496`f324e4f9 feafc9c1`1796ffa1 : ntdll!NtCreateSection+0x14
00000010`0e3f8d60 00007ffe`c0515640 : 00000129`5f442be0 0000001b`00[PII_REDACTED]7ffe`c1f72[PII_REDACTED]0`00000022 : KERNELBASE!BasepLoadLibraryAsDataFileInternal+0x2e7
00000010`0e3f8f90 00007ffe`c04fc41d : 00000129`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : KERNELBASE!LoadLibraryExW+0xe0
00000010`0e3f9000 00007ffe`c16903d1 : 00000129`5f414f00 00000000