CVE-2015-6856

Related Files

Dell Authentication Driver Uncontrolled Write

Posted Dec 18, 2015

Authored by Matthew Bergin

The Dell Pre-Boot Authentication Driver (PBADRV.sys) contains a vulnerability that can be leveraged to enable an attacker to write arbitrary code. The 'OutputAddress' from the IOCTL call is not validated before it attempts to write to memory. The content of the write is a four-byte hex value that is always greater than that of the kernel base address. Using multiple writes, it may be possible to overwrite the first entry of HalDispatchTable in a way that the entry would point to a user-land address. An attacker need only allocate shellcode at said address and call the ntdll!NtQueryIntervalProfile() function.

tags | exploit, arbitrary, kernel, shellcode

advisories | CVE-2015-6856

SHA-256 | 4c39d7663202b0e6a4d111b2cedc2d39282bb058581eda40719607e5ea6add5a

Download | Favorite | View