AFD.SYS DANGLING POINTER VULNERABILITY

[Nytro]

AFD.SYS DANGLING POINTER VULNERABILITY

Pwn2Own 2014

TABLE OF CONTENTS
Affected OS ......................................................................................................................................................................... 2
Overview ............................................................................................................................................................................. 2
Impact ................................................................................................................................................................................. 2
Technical Analysis ............................................................................................................................................................... 3
POC code ......................................................................................................................................................................... 3
Vulnerability Analysis ...................................................................................................................................................... 4
Step 1 - IOCTL 0x1207f ................................................................................................................................................ 5
Step 2 - IOCTL 0x120c3 ............................................................................................................................................... 8
Exploitation ..................................................................................................................................................................... 9
READ-/WRITE-Primitives through WorkerFactory Objects ....................................................................................... 10
Controlled Data on NonPagedPoolNx Pool ............................................................................................................... 11
Leak Target ............................................................................................................................................................... 12
Single-Gadget-ROP for SMEP Evasion ....................................................................................................................... 12
Shellcode ................................................................................................................................................................... 13
Putting it all together ................................................................................................................................................ 13
Patch Analysis ................................................................................................................................................................... 14

Download: http://www.siberas.de/papers/Pwn2Own_2014_AFD.sys_privilege_escalation.pdf