Closed benoitsevens closed 5 years ago
Hi @b3n7s
This is a known issue and there is nothing much we can do for this.
The solution that you are proposing is having the same issue as the current implementation.
Even if we pick min(), then also it doesn't give guarantee that the pages would be mapped.
However, there is no issue copying the junk data in the kernel stack buffer because it's not being used in some critical operation.
Also, not that if the page is not mapped then there would not be crash because ProbeForRead would find this and throw a exception which will be handled by try/catch
Thank you.
@b3n7s is this issue good to be closed?
@hacksysteam Of course. Sorry for the late reply :)
Hello,
I don't think this is very important but just a very little detail.
In the secure version of
Driver/Stackoverflow.c
wouldn't it be more logical to replace:with:
In the case that DeviceIoControl provides a buffer with
Size
smaller thansizeof(KernelBuffer)
, the driver will copy garbage to its stack, or maybe trigger an exception if that memory is not mapped in user land. I don't think this is exploitable (so it does not make it UNSECURE), but it just seems not very logical.Regards