1.Description:
The HookCentre.sys kernel driver distributed with G Data TotalCare 2011
contains a race condition vulnerability in the handling arguments of
NtOpenkey function.
Exploitation of this issue allows an attacker to crash system(make infamous
BSoD) or gain escalated priviligies.
An attacker would need local access to a vulnerable computer to exploit this
vulnerability.
Affected application: G Data TotalCare 2011, up to date version 21.1.0.5.
Affected file: HookCentre.sys version 10.0.8.11.
2.Crash dump info:
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain bad or
it
is pointing at freed memory.
Arguments:
Arg1: 90909090, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 80536913, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
READ_ADDRESS: 90909090
FAULTING_IP:
nt!memcpy+33
80536913 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
MM_INTERNAL_CODE: 0
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: hookfuzz.exe
TRAP_FRAME: f06f7c24 -- (.trap 0xfffffffff06f7c24)
ErrCode = 00000000
eax=909090ea ebx=0012ff08 ecx=00000016 edx=00000002 esi=90909090
edi=81ae5d2c
eip=80536913 esp=f06f7c98 ebp=f06f7ca0 iopl=0 nv up ei pl nz ac po
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010212
nt!memcpy+0x33:
80536913 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
Resetting default scope
LAST_CONTROL_TRANSFER: from 804f7b9d to 80527bdc
STACK_TEXT:
f06f7760 804f7b9d 00000003 90909090 00000000
nt!RtlpBreakWithStatusInstruction
f06f77ac 804f878a 00000003 00000000 c0484848 nt!KiBugCheckDebugBreak+0x19
f06f7b8c 804f8cb5 00000050 90909090 00000000 nt!KeBugCheck2+0x574
f06f7bac 8051cc4f 00000050 90909090 00000000 nt!KeBugCheckEx+0x1b
f06f7c0c 8054051c 00000000 90909090 00000000 nt!MmAccessFault+0x8e7
f06f7c0c 80536913 00000000 90909090 00000000 nt!KiTrap0E+0xcc
f06f7ca0 f9cbc7d5 81ae5d2c 90909090 0000005a nt!memcpy+0x33
WARNING: Stack unwind information not available. Following frames may be
wrong.
f06f7cc0 f9cbd818 0012ff08 0012ff08 00000000 HookCentre+0x7d5
f06f7cd8 f9cbddd2 00000001 00000188 000006cc HookCentre+0x1818
f06f7d28 f9cbe50b 00000188 000006cc 000007d8 HookCentre+0x1dd2
f06f7d50 8053d638 0012ff04 00020000 00000000 HookCentre+0x250b
f06f7d50 7c90e4f4 0012ff04 00020000 00000000 nt!KiFastCallEntry+0xf8
0012fec4 7c90d5bc 004010d0 0012ff04 00020000 ntdll!KiFastSystemCallRet
0012fec8 004010d0 0012ff04 00020000 0012feec ntdll!ZwOpenKey+0xc
0012ff70 00401622 00000001 00342e68 00342e98 hookfuzz!wmain+0xd0
0012ffc0 7c817067 fdd46ae8 01cb4211 7ffdd000
hookfuzz!__tmainCRTStartup+0x15e
0012fff0 00000000 00401679 00000000 78746341 kernel32!BaseProcessStart+0x23
STACK_COMMAND: kb
FOLLOWUP_IP:
HookCentre+7d5
f9cbc7d5 83c40c add esp,0Ch
SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: HookCentre+7d5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: HookCentre
IMAGE_NAME: HookCentre.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c75a6b8
FAILURE_BUCKET_ID: 0x50_HookCentre+7d5
BUCKET_ID: 0x50_HookCentre+7d5
Followup: MachineOwner
---------
3.PoC is in NtOpenKey_poc.zip file.
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15444.zip (NtOpenKey_poc.zip)
