NT drivers are potentially vulnerable to format string bug

Many NT drivers are potentially vulnerable to "format string bug".
The problem is concerned with DbgPrint function that is used for debug
messages. Some drivers instead of directly call of this function use
additional intermediate functions. Those functions add a prefix to an
outputted string, resolve a string format and pass the final string to
DbgPrint. Note the DbgPrint also additionally resolves format
specifications. A typical intermediate function looks like this:

void DebugMessage(const char * format, …)
{
char buf[1024];
int outLen;
ULONG PrefLen;
va_list argptr;

 strcpy(buf, "DriverName: ");
 PrefLen = strlen(buf);
 va_start( argptr, format );
 outLen = _vsnprintf( buf+PrefLen, sizeof(buf)-PrefLen, format, argptr );
 va_end( argptr );
 DbgPrint(buf);

}

As you can see it looks like clean code. But since DbgPrint function
uses string format resolving the DebugMessage function is vulnerable.
So the following function call is vulnerable:

DebugMessage("MajorFunction = %d, filename = "%-*S\n",
CurrentLocation->MajorFunction, FileObject->FileName. Length,
FileObject->FileName.Buffer);

All drivers that use such technique and retain the debug messages in
the release build are potentially vulnerable to format string
behaviors. Unfortunately researching of this problem shows that many
drivers use it. For example, NuMega's DriverWorks has a potentially
vulnerable class KTrace. In consequence all drivers written with
DriverWorks KTrace class and debug messages in the release build are
potentially vulnerable. The isapnp.sys driver coming with Windows 2000
also use such technique.

The bug is highly dangerous because it can leads to a possible patch
of the kernel memory. You can download the example of an attack on the
vulnerability here: http://www.securewave.com/ on "Free downloads"
section. The example contains a simple vulnerable driver that calls
DebugMessage as described above and a small user mode program that
exploits a driver vulnerability to patch the kernel. The patch allows
bypass all the system security checks. Thus any user can gain full
access for any file, install and start drivers and so on.

Andrey Kolishak mailto:[email protected]