Remote Code Execution Flaw in Windows Secure Channel Allows Malicious File Injection

A recent in-depth review of a security flaw within Microsoft’s Secure Channel has uncovered a severe issue that could facilitate remote code execution.

Originally flagged as an integer overflow problem, the vulnerability has been reclassified following further analysis as a Use-After-Free (UAF) vulnerability. A UAF flaw occurs when a program continues to access a memory pointer after the memory it points to has been deallocated, which can lead to unpredictable behaviors and exploitation risks.

In a newly published technical review, the researcher who reported this issue to Microsoft has detailed their findings. Here’s an overview of the technical aspects.

Technical Review

The flaw was traced back to the CSsl3TlsContext::CSsl3TlsContext function. Microsoft addressed the issue with a patch that introduced a conditional check to prevent a problematic assignment operation:

if ( !(unsigned __int8)wil::details::FeatureImpl<__WilFeatureTraits_Feature_2612696381>::__private_IsEnabled(&`wil::Feature<__WilFeatureTraits_Feature_2612696381>::GetImpl'::`2'::impl) )
{
  *(_QWORD *)(this + 472) = *(_QWORD *)(a2 + 472);
  *(_QWORD *)(a2 + 472) = 0i64;
}

This patch successfully blocked the assignment of a specific field when a certain feature was enabled.

Further binary analysis using IDA revealed that a new memory allocation (referred to as M1) was assigned to the field at offset 472 (hexadecimal: 1D8h) within the CSsl3TlsServerContext::ProcessRecord function. The CTlsMessageFragment::Initialize function was observed to assign a pointer to this newly allocated memory, potentially leading to a UAF vulnerability.

void __fastcall CTlsMessageFragment::Initialize(CTlsMessageFragment *this, struct CSsl3TlsContext *a2)
{
  int v2; // eax
  int v3; // edx
  unsigned int v4; // edx
  unsigned int v5; // eax

  *(_QWORD *)this = a2;
  ......
  v3 = 1536;
LABEL_9:
  *((_DWORD *)this + 3) = v3;
  v5 = *((_DWORD *)this + 2);
  if ( v5 > 0xFFFFFF )
    v5 = 0xFFFFFF;
  *((_DWORD *)this + 2) = v5;
}

The review found that, while the patch set the 472nd field of the a2 structure to zero, the first field of M1 was left unchanged. This lapse allowed M1’s first field to retain a reference to a2, thus creating a UAF vulnerability during the memory release process.

The researcher confirmed, “After thorough testing, it’s clear that the UAF issue is present at this location. The virtual table of the structure is utilized, and if the position is appropriately manipulated, it could lead to direct control of the instruction pointer (rip). With the right techniques, remote code execution is feasible.”

The potential impact of this vulnerability is severe. If exploited, it could enable unauthenticated remote code execution, allowing attackers to execute arbitrary code on a remote system without prior authentication, thus representing a serious security threat.

The researcher acknowledged that the initial misjudgment was due to a lack of experience and an overemphasis on bytecode parsing rather than identifying the UAF issue. This case highlights the necessity of meticulous analysis and patience in cybersecurity investigations.

Although the vulnerability has been patched, this incident serves as a reminder of the intricate nature of software security and the ongoing need for vigilant and detailed scrutiny of security patches to address all possible vulnerabilities effectively.

CYPHERLOCK, INC.