TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Windows System Exploit

92 pointsby maxdelisoover 12 years ago

8 comments

muninover 12 years ago
the bluescreen is because, well, "CRITICAL_OBJECT_TERMINATION". in Windows, some processes, if they terminate, cause the entire operating system to stop with a bugcheck. think of it like init dying in linux.<p>there sadly is no 'stack backtrace'. it looks like he's managed to send some message to csrss.exe that caused it to crash with an invalid memory operation.<p>this is bad, it might even be exploitable. even though the exploit would be in csrss, which is not kernel mode, it's still extremely important and trusted. also, untrusted low-user code could make this call to privilege escalate.<p>it's worth noting that thought the author states " I stumbled accross the bug inadvertently while working on something totally unrelated to security, and decided to publish my findings so that this can be fixed by Microsoft.", microsoft actually has a security team that can be found here: <a href="http://technet.microsoft.com/en-us/security/ff852094.aspx" rel="nofollow">http://technet.microsoft.com/en-us/security/ff852094.aspx</a> (google for "microsoft report security bug")<p>the bugs you report to them remain confidential until they are fixed. this way, potentially bad exploit code isn't floating around the internet for some indeterminate amount of time. like this!
评论 #4663384 未加载
twoodfinover 12 years ago
This isn't really an exploit, except insofar as a local user can cause a DoS for the system. Until there's a demonstration that arbitrary code can be invoked with elevated privileges, it's just a bug.
评论 #4663240 未加载
easy_riderover 12 years ago
Untill proven otherwise this totally violates full Disclosure policies. I know they are like 'gentleman agreements' but this feels bad, and looks bad, like the author is only out for some internet fame. I can not believe that he in any way tried to contact Microsoft, but clearly took his time on this publication.
评论 #4663559 未加载
评论 #4664096 未加载
评论 #4665166 未加载
yuhongover 12 years ago
Call stack from WinDbg:<p><pre><code> ChildEBP RetAddr 8942ec9c 82b1d2a1 nt!KeBugCheckEx+0x1e 8942ecc0 82a9ae5a nt!PspCatchCriticalBreak+0x71 8942ecf0 82a9ad9d nt!PspTerminateAllThreads+0x2d 8942ed24 8287b8fa nt!NtTerminateProcess+0x1a2 8942ed24 77b87094 nt!KiFastCallEntry+0x12a 00f8f260 77b868d4 ntdll!KiFastSystemCallRet 00f8f264 75d3301f ntdll!ZwTerminateProcess+0xc 00f8f2a4 75d34d7c CSRSRV!CsrUnhandledExceptionFilter+0xcb 00f8f2ac 75d36f48 CSRSRV!CsrApiRequestThread+0x3e2 00f8f2c0 75d36cde CSRSRV!_EH4_CallFilterFunc+0x12 00f8f2e8 77b87199 CSRSRV!_except_handler4+0x8e 00f8f30c 77b8716b ntdll!ExecuteHandler2+0x26 00f8f330 77b5f98f ntdll!ExecuteHandler+0x24 00f8f3bc 77b86ff7 ntdll!RtlDispatchException+0x127 00f8f3bc 77b92cc7 ntdll!KiUserExceptionDispatcher+0xf 00f8f708 77b92c78 ntdll!RtlpLowFragHeapFree+0x31 00f8f720 75c6b349 ntdll!RtlFreeHeap+0x105 00f8f734 75c72ce2 sxs!operator delete+0x1c 00f8f740 75c724f6 sxs!RawStack::~RawStack+0x12 00f8f74c 75c72484 sxs!XMLParser::~XMLParser+0x68 00f8f758 75c72e7c sxs!XMLParser::`scalar deleting destructor'+0xd 00f8f76c 75c686f3 sxs!_unknown&#60;IXMLParser,&#38;IID_IXMLParser&#62;::Release+0x27 00f8f77c 75c73e1f sxs!CSmartRef&#60;IXMLParser&#62;::~CSmartRef&#60;IXMLParser&#62;+0x1b 00f8f7fc 75c74a37 sxs!SxspIncorporateAssembly+0x5db 00f8f83c 75c78001 sxs!SxspIncorporateAssembly+0xb8 00f8f874 75c6a944 sxs!SxspCloseManifestGraph+0x7c 00f8f928 75ce28c7 sxs!SxsGenerateActivationContext+0x48f 00f8fa90 75ce1ad3 sxssrv!BaseSrvSxsCreateActivationContextFromStruct+0x490 00f8fac8 75d34d65 sxssrv!BaseSrvSxsCreateActivationContextFromMessage+0xdb 00f8fc40 77b45e7a CSRSRV!CsrApiRequestThread+0x3cb 00f8fc80 77ba374e ntdll!__RtlUserThreadStart+0x28 00f8fc98 00000000 ntdll!_RtlUserThreadStart+0x1b</code></pre>
kyberiasover 12 years ago
I think this it utterly irresponsible to publish without trying to contact Microsoft's security team first. Why on earth?
评论 #4663570 未加载
评论 #4663513 未加载
评论 #4663619 未加载
kyberiasover 12 years ago
Ok, tried it. This DOES NOT trigger blue screen on Windows 8 (64bit) / Visual Studio 2012. I'm pretty sure the author has some other problems in his environment.
评论 #4664277 未加载
wcchandlerover 12 years ago
I hate the idea of "full disclosure." I, instead, love what this author has done. You found a bug, you're posting about it. Great. Any decent, respectable, commercial enterprise should have <i>somebody</i> watching sites like this, looking for posts like these. They shouldn't rely on somebody taking time away from themselves or their projects and write up a bug report. No.
评论 #4664095 未加载
评论 #4664493 未加载
verroqover 12 years ago
&#62;but to make life simple for programmer's<p>Programmer's what?
评论 #4663331 未加载