Windows: Impersonation Check Bypass

[Nytro]

Windows: Impersonation Check Bypass With CryptProtectMemory and CRYPTPROTECTMEMORY_SAME_LOGON flag

Reported by fors.. @google.com, Oct 17, 2014 Platform: Windows 7, 8.1 Update 32/64 bit

Class: Security Bypass/Information Disclosure

The function CryptProtectMemory allows an application to encrypt memory for one of three scenarios, process, logon session and computer. When using the logon session option (CRYPTPROTECTMEMORY_SAME_LOGON flag) the encryption key is generated based on the logon session identifier, this is for sharing memory between processes running within the same logon. As this might also be used for sending data from one process to another it supports extracting the logon session id from the impersonation token.

The issue is the implementation in CNG.sys doesn't check the impersonation level of the token when capturing the logon session id (using SeQueryAuthenticationIdToken) so a normal user can impersonate at Identification level and decrypt or encrypt data for that logon session. This might be an issue if there's a service which is vulnerable to a named pipe planting attack or is storing encrypted data in a world readable shared memory section.

This behaviour of course might be design, however not having been party to the design it's hard to tell. The documentation states that the user must impersonate the client, which I read to mean it should be able to act on behalf of the client rather than identify as the client.

Attached is a simple PoC which demonstrates the issue. To reproduce follow the steps.

1) Execute Poc_CNGLogonSessionImpersonation.exe from the command line

2) The program should print "Encryption doesn't match" to indicate that the two encryptions of the same data was not a match, implying the key was different between them.

Expected Result:

Both calls should return the same encrypt data, or the second call should fail

Observed Result:

Both calls succeed and return different encrypted data

This bug is subject to a 90 day disclosure deadline. If 90 days elapse

without a broadly available patch, then the bug report will automatically

become visible to the public.

[TABLE]

[TR]

[TD] [/TD]

[TD] Poc_CNGLogonSessionImpersonation.zip

62.4 KB Download[/TD]

[/TR]

[/TABLE]

Sursa: https://code.google.com/p/google-security-research/issues/detail?id=128