Exploit-DB #35182
Description: VMware Workstation 10.0.0.40273 - 'vmx86.sys' Arbitrary Kernel Read
Type: dos
Platform: windows_x86
Date: 2014-11-06
Author: KoreLogic

Exploit:
Title: VMWare vmx86.sys Arbitrary Kernel Read
Advisory ID: KL-001-2014-004
Publication Date: 2014.11.04
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2014-004.txt


1. Vulnerability Details

     Affected Vendor: VMWare
     Affected Product: Workstation
     Affected Version: 10.0.0.40273
     Platform: Microsoft Windows XP SP3 x86, Microsoft Windows Server 2003 SP2 x86, Microsoft Windows 7 SP1 x86
     CWE Classification: CWE-20: Improper Input Validation
     Impact: Arbitrary Read, Denial-of-Service
     Attack vector: IOCTL

2. Vulnerability Description

     A vulnerability within the vmx86 driver allows an attacker
     to specify a memory address within the kernel and have the
     memory stored at that address be returned to the attacker.

3. Technical Description

     The first four bytes of the InputBuffer parameter passed
     to DeviceIoControl is used as the source parameter in a memcpy
     call. The InputBuffer must be a minimum of eight bytes long in
     order to trigger the vulnerability. The OutputBuffer parameter
     passed to DeviceIoControl is used as the destination address
     for the output from the DeviceIoControl call. In this case,
     the data returned is the same data residing at the source
     paramter of memcpy.  This can therefore be abused in a way
     that allows an attacker to arbitrarily define a kernel address,
     and have the memory stored at that address be returned to the
     attacker at an address residing in userland.

Probably caused by : vmx86.sys ( vmx86+bd6 )

Followup: MachineOwner
---------

kd> .symfix;.reload;!analyze -v
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols
.........................
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffff0000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 82c727f3, If non-zero, the instruction address which referenced the bad memory
     address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------

READ_ADDRESS:  ffff0000 
FAULTING_IP: 
nt!memcpy+33
82c727f3 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE:  0
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  python.exe
CURRENT_IRQL:  0
ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg)[PII_REDACTED]) x86fre
TRAP_FRAME:  822e47dc -- (.trap 0xffffffff822e47dc)
ErrCode = 00000000
eax=ffff2000 ebx=87433558 ecx=00000800 edx=00000000 esi=ffff0000 edi=856a9000
eip=82c727f3 esp=822e4850 ebp=822e4858 iopl=0         nv up ei pl nz ac po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010212
nt!memcpy+0x33:
82c727f3 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
Resetting default scope
LAST_CONTROL_TRANSFER:  from 82c7a3d8 to 82cc741b
STACK_TEXT:  
822e47c4 82c7a3d8 00000000 ffff0[PII_REDACTED]0 nt!MmAccessFault+0x106
822e47c4 82c727f3 00000000 ffff0[PII_REDACTED]0 nt!KiTrap0E+0xdc
822e4858 93572bd6 856a9000 ffff0[PII_REDACTED]0 nt!memcpy+0x33
822e48cc 9357329a 856a9[PII_REDACTED]8 856a9000 vmx86+0xbd6
822e48f8 82c70593 86f0d030 [PII_REDACTED] vmx86+0x129a
822e4910 82e6499f 871f8b08 87[PII_REDACTED]35b0 nt!IofCallDriver+0x63
822e4930 82e67b71 86f0d030 871f8b08 00000000 nt!IopSynchronousServiceTail+0x1f8
822e49cc 82eae3f4 86f0d030 [PII_REDACTED] nt!IopXxxControlFile+0x6aa
822e4a00 821210fa 0000007c [PII_REDACTED] nt!NtDeviceIoControlFile+0x2a
822e4b14 82cb7685 [PII_REDACTED] 00000000 nt!KiDeliverApc+0x17f
822e4b58 82cb64f7 00[PII_REDACTED]9a10 80000000 nt!KiSwapThread+0x24e
822e4b80 82cb61d5 85689a10 85689ad0 0000008a nt!KiCommitThreadWait+0x1df
822e4bd8 82e639fd 01b1fd01 00000001 822e4bc8 nt!KeDelayExecutionThread+0x2aa
822e4c24 82c771ea 00000001 01b1ff54 01b1ff78 nt!NtDelayExecution+0x8d
822e4c24 777c70b4 00000001 01b1ff54 01b1ff78 nt!KiFastCallEntry+0x12a
01b1ff0c 777c57d4 75a3[PII_REDACTED]1 01b1ff54 ntdll!KiFastSystemCallRet
01b1ff10 75a3[PII_REDACTED]1 01b1ff54 da57de5e ntdll!NtDelayExecution+0xc
01b1ff78 00401ed6 ffffffff 00000001 01b1ff94 KERNELBASE!SleepEx+0x65
01b1ff94 777e37f5 00000000 762fe46a 00000000 kernel32!BaseThreadInitThunk+0xe
01b1ffd4 777e37c8 00401ec0 [PII_REDACTED] ntdll!__RtlUserThreadStart+0x70
01b1ffec 00[PII_REDACTED]1ec0 [PII_REDACTED] ntdll!_RtlUserThreadStart+0x1b
STACK_COMMAND:  kb
FOLLOWUP_IP: 
vmx86+bd6
93572bd6 83c40c          add     esp,0Ch
SYMBOL_STACK_INDEX:  3
SYMBOL_NAME:  vmx86+bd6
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: vmx86
IMAGE_NAME:  vmx86.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  539a4f4e
FAILURE_BUCKET_ID:  0x50_vmx86+bd6
BUCKET_ID:  0x50_vmx86+bd6
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:0x50_vmx86+bd6
FAILURE_ID_HASH:  {fc58ae86-f23c-59c4-2a6e-428433bd6080}
Followup: MachineOwner
---------

kd> .frame /c 04; .cxr; .frame /c 03; .cxr; .frame /c 02
04 822e48f8 82c70593 vmx86+0x129a
eax=ffff2000 ebx=87433558 ecx=00000800 edx=00000000 esi=ffff0000 edi=856a9000
eip=9357329a esp=822e48d4 ebp=822e48f8 iopl=0         nv up ei pl nz ac po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010212
vmx86+0x129a: