Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

GDT and LDT in Windows kernel vulnerability exploitation (paper)
From: Gynvael Coldwind <gynvael () coldwind pl>
Date: Sun, 17 Jan 2010 01:53:48 +0100

Hi,

We've published a paper about using 1 or 4 byte write-what-where
condition to convert a custom Data-Segment Descriptor entry in LDT of
a process into a Call-Gate (with DPL set to 3 and RPL to 0).
The paper also contains information about a possible LDT redirecting
into user-land memory.

The paper is Windows NT family (starting from Windows 2000 and XP) and
x86 protected mode specific.

The paper DOES NOT contain information about new or old
vulnerabilities. It only proposes a way to convert a potential
write-what-where vulnerability into code execution, in a stable
manner.

http://vexillium.org/dl.php?call_gate_exploitation.pdf

More information is available on our blogs:
http://gynvael.coldwind.pl/?id=274
http://j00ru.vexillium.org/?p=290&lang=en

Comments are welcomed :)

Take care,
-- 
gynvael.coldwind//vx and j00ru//vx

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • GDT and LDT in Windows kernel vulnerability exploitation (paper) Gynvael Coldwind (Jan 17)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]