CommSec D1 - The Life & Death of Kernel Object Abuse

on YouTube ↗40m

" summary

Survey of concrete exploit techniques against Win32k GDI: shows GDI Bitmaps (surf) and GDI Palettes abused to get relative/arbitrary kernel read/write, using pool spraying and deterministic allocations to overwrite PVScan0 or PFirstColor and then swap a process token to SYSTEM (demo drops a SYSTEM shell). Traces history (2015 bitmap work, 2017 palette disclosure) and presents the mitigation Type Isolation (RS4): per-type heaps, zero-on-free and slot bitmaps to prevent UAF → arbitrary R/W; mitigation is deployed and effective for covered types.

AI-written summary · about

" chapters (23)

1. 0:00Intro
2. 0:47Attack Chain
3. 1:47Memory Corruption - UAF - Use
4. 2:02Memory Corruption - UAF - Exploitation
5. 2:52Memory Corruption - x86 Integer Overflow
6. 3:35Memory Corruption - Linear Overflow
7. 4:43Memory Corruption - OOB Write
8. 5:15Memory Corruption - OOB OF Exploitation
9. 7:43Win32k Memory
10. 8:38Statistics
11. 13:58Abusing Bitmaps SURFOBJ - Exploitation
12. 16:08Abusing Palettes PALETTE - Allocation
13. 16:48Abusing Palettes PALETTE - Read Data
14. 18:50Demo
15. 22:24The Type Isolation Mitigation
16. 25:59Not in Our Threat Model
17. 27:21Type Isolation Doesn't Prevent UAFs
18. 28:58Deny the Attacker Control of Memory
19. 29:40Overlapping Different Types of Objects
20. 31:10How Type Isolation Works
21. 33:21UAF Scenario 2
22. 36:06Similar Work
23. 37:32Our Impact

" related talks

• 25mData-Only Pwning Microsoft Windows KernelNikita Tarakanov · Black Hat USA 2014
• 52mA New CVE-2015-0057 Exploit TechnologyYu Wang · Black Hat Asia 2016
• 56mWindows Kernel Graphics Driver Attack SurfaceIlja van Sprundel · Black Hat USA 2014
• 46mFor The Win: The Art Of The Windows Kernel FuzzingGuangming Liu · HITBSecConf 2019 Amsterdam
• 38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-ExploitationRuben Boonen, Valentina Palmiotti · Black Hat USA 2023
• 33mExploring a New Class of Kernel Exploit PrimitiveRohit Mothe, Andrew Ruddick · Black Hat Europe 2022
• 53mUnderstanding TOCTTOU in the Windows Kernel Font Scaler EngineYu Wang · Black Hat USA 2014
• 40mEvils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIsXingyu Jin, Tony Mendez, Richard Neal · Black Hat Europe 2023