CERT-In Vulnerability Note
CIVN-2010-0224
Multiple Vulnerabilities in Microsoft Kernel-Mode Drivers
Original Issue Date:October 15, 2010
Severity Rating: MEDIUM
Systems Affected
- Windows XP 3
- Windows XP Professional x64 Edition SP 2
- Windows Server 2003 SP 2
- Windows Server 2003 x64 Edition SP 2
- Windows Server 2003 with SP2 for Itanium-based Systems
- Windows Vista SP 1 & SP 2
- Windows Vista x64 Edition SP 1& SP 2
- Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems SP 2 (including Server-Core installation)
- Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems SP 2 (including Server-Core installation)
- Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems SP 2
- Windows 7 for 32-bit systems
- Windows 7 for x-64-based systems
- Windows Server 2008 R2 for x64-based Systems (including Server-Core installation)
- Windows Server 2008 R2 for Itanium-based systems
Overview
Multiple vulnerabilities have been reported in Microsoft Kernel-mode Drivers; successful exploitation of these vulnerabilities could elevate privileges on vulnerable system or cause Denial of Service (DoS) by a local attacker with va lid logon credentials The vulnerability could not be exploited remotely or by anonymous users.
Description
The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling.
Win32k.sys is a kernel-mode device driver and is the kernel part of the Windows subsystem. It contains the window manager, which controls window displays; manages screen output; collects input from the keyboard, mouse, and other devices; and passes user messages to applications. It also contains the Graphics Device Interface (GDI), which is a library of functions for graphics output devices. Finally, it serves as a wrapper for DirectX support that is implemented in another driver (dxgkrnl.sys).
1. Win32k reference count Vulnerability
(
CVE-2010-2549
)
The use-after-free vulnerability allows local users to cause a denial of service (crash) by using a large number of calls to the NtUserCheckAccessForIntegrityLevel function to trigger a failure in the LockProcessByClientId function, which causes a process object to be deleted while it is still in use. Note: A proof of concept code for this vulnerability is publically available on Internet. .
2 . Win32k keyboard layout vulnerability
(
CVE-2010-2743
)
The windows kernel-mode driver does not properly index a table of function pointers when loading keyboard layout from disk which when processed cause the Windows kernel to improperly index memory pointers, resulting in memory corruption. Note: Stuxnet malware currently leverages this vulnerability for local elevation of privilege if run on Windows XP.
3. Win32k window class Vulnerability
(
CVE-2010-2744
)
This is an elevation of privilege vulnerability which is caused as the Windows kernel-mode drivers (win32k.sys) do not properly validate the windows class data. Which when processed cause an error condition in the kernel.
Solution
Apply appropriate updates as mentioned in the Microsoft Security Bulletin
MS10-073
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/MS10-073.mspx
References
Cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=20814
http://tools.cisco.com/security/center/viewAlert.x?alertId=21468
http://tools.cisco.com/security/center/viewAlert.x?alertId=21469
Secunia
http://secunia.com/advisories/40421
http://secunia.com/advisories/41775
SecurityTracker
http://securitytracker.com/alerts/2010/Aug/1024308.html
VUPEN
http://www.vupen.com/english/advisories/2010/2620
SecurityFocus
http://www.securityfocus.com/bid/41280
CVE Name
CVE-2010-2549
CVE-2010-2743
CVE-2010-2744
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|