35 lines
1.1 KiB
Plaintext
35 lines
1.1 KiB
Plaintext
# What day-zero dug up in tcpip.sys
|
|
|
|
Windows TCP/IP driver, 8,421 functions, no symbols. These are leads, not
|
|
confirmed bugs — spots worth opening in Ghidra, not proof of anything.
|
|
|
|
A length going into `NdisGetDataBuffer`:
|
|
|
|
```
|
|
len = ((arg2 & 0xf) << 2) - 20
|
|
```
|
|
|
|
Low nibble times 4, minus 20 — a header-length field in 4-byte words with a
|
|
20-byte header subtracted off. Nibble under 5 and it underflows to ~4GB.
|
|
|
|
A length walked through four functions, none of them bounding it, from a network
|
|
entry point down into a packet parser:
|
|
|
|
```
|
|
0x1400557d0 -> 0x140053d04 -> 0x14006323c -> 0x140061850 -> NdisGetDataBuffer
|
|
```
|
|
|
|
Every hop assumes someone else checked it.
|
|
|
|
A handful of WFP functions (`WfpBufferCopy`,
|
|
`WfpHandOffTupleStateToTemporaryAleEntry`) hand an unchecked value straight to
|
|
`ExAllocatePool2` as the allocation size. One computes it as `(input << 4) + 0x2e`
|
|
— multiply attacker input by 16, allocate that.
|
|
|
|
And the spots that *do* bound the same `(nibble << 2)` length with a proper
|
|
`<= 0x14` check — flagged as fine, not as findings.
|
|
|
|
|
|
# Usage
|
|
Easy start:
|
|
```py binspect.py tcpip.sys --trace``` |