失之交臂的 cve 2012-0181

1: kd> p

win32k!ReadLayoutFile+0x123:

bf89edb7 7407 je win32k!ReadLayoutFile+0x12c (bf89edc0)

1: kd> p

win32k!ReadLayoutFile+0x125:

bf89edb9 0fb703 movzx eax,word ptr [ebx] 原本这个内存范围是从e294b008--e294ba68，此时这个指针已经被改写了

1: kd> db ebx

e294a008 49 a5 1e 82 ff 03 1f 00-00 00 00 00 0c 08 00 00 I...............

e294a018 00 00 00 00 10 08 00 00-00 00 00 00 14 08 00 00 ................

e294a028 00 00 00 00 18 08 00 00-00 00 00 00 1c 08 00 00 ................

e294a038 00 00 00 00 20 08 00 00-00 00 00 00 24 08 00 00 .... .......$...

e294a048 00 00 00 00 28 08 00 00-00 00 00 00 2c 08 00 00 ....(.......,...

e294a058 00 00 00 00 30 08 00 00-00 00 00 00 34 08 00 00 ....0.......4...

e294a068 00 00 00 00 38 08 00 00-00 00 00 00 3c 08 00 00 ....8.......<...

e294a078 00 00 00 00 40 08 00 00-00 00 00 00 44 08 00 00 ....@.......D...

1: kd> .trap 0xffffffffb235689c

ErrCode = 00000000

eax=e2954551 ebx=e294a008 ecx=e294a008 edx=e294b008 esi=00000000 edi=fffff000

eip=bf89edc2 esp=b2356910 ebp=b2356944 iopl=0 nv up ei ng nz ac po nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010292

win32k!ReadLayoutFile+0x12e:

bf89edc2 3930 cmp dword ptr [eax],esi ds:0023:e2954551=????????

这个漏洞之前看过

.text:BF882230 mov edi, [ebp+arg_8_is_tainted]

.text:BF882233 sub edi, [eax+0Ch]

这个地方的Section RVA 过大会导致上面分配的内存指针被改写了

当时在idb里面写了句注释



并没有对下面仔细看了，因为这个漏洞在win7下面必须要是管理员权限，xp sp3 下微软也不会重视？ 漏洞意义不大，草草看完了事.......