double fetch bug in the secure WriteNULL

hacksysteam / HackSysExtremeVulnerableDriver

HackSys Extreme Vulnerable Driver (HEVD) - Windows & Linux

https://hacksys.io

GNU General Public License v3.0

2.42k stars 525 forks source link

double fetch bug in the secure WriteNULL #38

Closed Shoshkin closed 4 years ago

Shoshkin commented 4 years ago

it checks the address to write into from UserBuffer, then reads the address again from the buffer The address inside UserBuffer can be changed (from another thread) right after ProbeForWrite, just before the actual write

The bug is hard to reproduce since the time slot is really small Easiest way to reproduce is to create a delay after ProbeForWrite, giving enough time for the second thread to change the address.

hacksysteam commented 4 years ago

@Shoshkin Very nice! Good catch. Thanks for the PR!