search

asanso / google-security-research

Automatically exported from code.google.com/p/google-security-research
0 stars 0 forks source link

Kaspersky Antivirus "Yoda's Protector" unpacking remote memory corruption #528

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
The attached testcase was found by fuzzing packed PE files, I suspect it was 
packed using "Yoda's protector". This vulnerability is obviously exploitable 
for remote code execution as NT AUTHORITY\SYSTEM on all systems using Kaspersky 
Antivirus.

(bb8.ff0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=b5118b71 ebx=0000f8f0 ecx=0515f124 edx=b5118b71 esi=0bfe0e38 edi=0bfe005c
eip=71db9229 esp=0515f0f0 ebp=0515f0f4 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
kavbase_kdl!KLAV_Engine_Create+0x78227:
71db9229 8b4230          mov     eax,dword ptr [edx+30h] 
ds:002b:b5118ba1=????????

What does it do with that value once it's loaded?

0:029> u
kavbase_kdl!KLAV_Engine_Create+0x78227:
71db9229 8b4230          mov     eax,dword ptr [edx+30h] <-- dereference bad 
pointer
71db922c 57              push    edi
71db922d 8b38            mov     edi,dword ptr [eax] <-- dereference again
71db922f 51              push    ecx
71db9230 8b0a            mov     ecx,dword ptr [edx]
71db9232 8b5730          mov     edx,dword ptr [edi+30h] <-- dererence again
71db9235 56              push    esi
71db9236 51              push    ecx
0:029> u
kavbase_kdl!KLAV_Engine_Create+0x78235:
71db9237 50              push    eax
71db9238 ffd2            call    edx     <-- attacker gets control of execution 
and parameters
71db923a 83c410          add     esp,10h
71db923d 5f              pop     edi
71db923e 5e              pop     esi
71db923f 5d              pop     ebp
71db9240 c3              ret

Where does that pointer come from?

3C 03 6C 9E 8C 7D A5 C5 F9 22 6E F9 71 8B 11 B5        <--- *
B0 4D 5B 5C A8 19 09 FE 36 1A B6 92 3A 92 96 78
95 BD 55 64 76 C5 87 7C 00 C4 C7 36 6E 24 87 9F
5F 12 AB 96 75 ED 11 CC D1 B1 0C 4C B8 88 9A 5D
07 A5 C0 C7 5E 19 04 44 FC 4C 0F 69 20 2E 70 7A

Directly from the input file, so this is obviously exploitable for remote code 
execution as NT AUTHORITY\SYSTEM.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by tav...@google.com on 10 Sep 2015 at 8:58

Attachments:

GoogleCodeExporter commented 9 years ago 
Kaspersky report they rolled out a fix on 13th September.

Original comment by tav...@google.com on 14 Sep 2015 at 5:38

GoogleCodeExporter commented 9 years ago

Original comment by tav...@google.com on 22 Sep 2015 at 5:23