full-disclosure-uk January 2010 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: [Full-disclosure] GDT and LDT in Windows ker

[Full-disclosure] GDT and LDT in Windows kernel vulnerability exploitation (paper)

From: Gynvael Coldwind <gynvael_at_nospam>
Date: Sun Jan 17 2010 - 00:53:48 GMT
To: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com


Hi,

We've published a paper about using 1 or 4 byte write-what-where condition to convert a custom Data-Segment Descriptor entry in LDT of a process into a Call-Gate (with DPL set to 3 and RPL to 0). The paper also contains information about a possible LDT redirecting into user-land memory.

The paper is Windows NT family (starting from Windows 2000 and XP) and x86 protected mode specific.

The paper DOES NOT contain information about new or old vulnerabilities. It only proposes a way to convert a potential write-what-where vulnerability into code execution, in a stable manner.

http://vexillium.org/dl.php?call_gate_exploitation.pdf

More information is available on our blogs: http://gynvael.coldwind.pl/?id=274
http://j00ru.vexillium.org/?p=290&lang=en

Comments are welcomed :)

Take care, -- gynvael.coldwind//vx and j00ru//vx _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/