漏洞描述
Microsoft Windows是微軟發布的非常流行的操作系統。
Microsoft SMB協議軟件在驗證某些SMB字段時存在SMB池溢出漏洞，遠程攻擊者可以通過向運行Server服務的系統發送特制的SMB_COM_TRANSACTION2請求導致執行任意代碼。
如果連接到SMB服務器的客戶端對共享擁有至少只讀權限，且客戶端創建的惡意Trans2 “QUERY_FS_INFO Query FS Attribute info”中Max DataCount參數設置為0，則在處理SMB_COM_TRANSACTION2請求時，srv.sys驅動的SrvSmbQueryFsInformation()函數會從ntoskrnl.exe調用NtQueryVolumeInformationFile(FileFsSizeInformation)。NtQueryVolumeInformationFile使用了從未經驗證用戶輸入所獲取的大小分配池塊：
kd> nt!NtQueryVolumeInformationFile+0x3de:
82a5779c ff7514 push dword ptr [ebp+14h] ;User controlled
82a5779f 50 push eax
82a577a0 e85d1fe6ff call nt!ExAllocatePoolWithQuotaTag (828b9702)
82a577a5 eb23 jmp nt!NtQueryVolumeInformationFile+0x40c (82a577ca)
kd>
NtQueryVolumeInformationFile函數的實際代碼如下：
NTSTATUS
NtQueryVolumeInformationFile(IN HANDLE FileHandle,
OUT PIO_STATUS_BLOCK IoStatusBlock,
OUT PVOID FileSystemInformation,
IN ULONG Length,
IN FS_INFORMATION_CLASS FileSystemInformationClass)
{
if (RequestorMode != KernelMode)
{
}
if (FileSystemInformationClass == FileFsDeviceInformation)
{
}
if (FileSystemInformationClass == FileFsDriverPathInformation)
{
PFILE_FS_DRIVER_PATH_INFORMATION Buffer, Source;
Source = (PFILE_FS_DRIVER_PATH_INFORMATION)FileSystemInformation;
Buffer = (PFILE_FS_DRIVER_PATH_INFORMATION)ExAllocatePoolWithQuota(NonPagedPool, Length);
RtlCopyMemory(Buffer, Source, Length);
NtStatus = IopGetDriverPathInformation(FileObject, Buffer, Length);
// [...]
if (Buffer) ExFreePool(Buffer);
}
// Issue;
//SystemBuffer, which is the buffer used for the I/O, can be allocated with
//a size of zero because of the lack of length sanity check.
//Later this buffer is used for various operations, which is the source of
//trouble when the I/O Manager tries to release the buffer.
Irp->AssociatedIrp.SystemBuffer = ExAllocatePoolWithQuota(NonPagedPool,
Length);
// This buffer is freed later by the Windows I/O Manager.
}
<*來源：laurent gaffié （laurent.gaffié@gmail.com）
鏈接：http://secunia.com/advisories/40935/
http://marc.info/?l=full-disclosure&m=128152325912209&w=2
http://www.microsoft.com/technet/security/Bulletin/MS10-054.mspx?pf=true
http://www.us-cert.gov/cas/techalerts/TA10-222A.html
*>
解決方法
廠商補丁:
Microsoft
---------
目前 Microsoft 已經發布安全公告，請按照 公告、KB 或 CVE 編號
從下面的鏈接搜索對應的補丁進行安裝。
鏈接：https://technet.microsoft.com/security/bulletin/