Defeating XP SP2 Heap Protection

hobo2k writes "XP SP2 included canary values and hardware-implemented execution protection in order to avoid exploitable buffer overruns. Now Positive Technologies has released an article describing one way that protection could be bypassed. To solve the problem, they provide a program which disables the small allocation heap as described here. CNET reports that SP2 has been foiled."

Comments

i know the drill

[numike]

firefox

Re:i know the drill

[freeJustin]

mayve you didnt read correctly this is a core issue, so to rephrase "I know the drill, *nix"

Re:i know the drill

[eomnimedia]

Actually:

Re:SP2 what?

[A beautiful mind]

it's like putting on a second condom AFTER sex when the first one proved to be leaking.

Just hold down Ctrl.

[agent dero]

C'mon, this has been known for a while ;)

NX bit?

[Anonymous Coward]

I read the .PDF pretty carefully, but I still don't understand how DEP (data execution protection via the NX bit in the page tables) fails to prevent this exploit. The 1016 bytes of memory is on the heap, isn't it? So how is any code you put there going to be executed?

Re:NX bit?

[Anonymous Coward]

The program disables the small allocation heap (meaning that the 1016 bytes of exploit code would be loaded into some other heap), which leads me to believe that perhaps the NX bit was only set for the small allocation heap pages. This will probably get fixed pretty quickly.

Re:NX bit?

[YU Nicks NE Way]

The article description is a bit deceptive. NX is independent of DEP here. The alleged exploit only works for the small heap on machines without NX, not for machines with NX. NX stops this exploit cold.

Re:Can you blame them?

[grolschie]

> Microsoft and security?

> Chalk and cheese?

Don't you mean simply "swiss cheese"? ;-)

This is way wrong.

[A beautiful mind]

"Published 28th January 2005."

And

"In October 2004 it was discovered by MaxPatrol team that it is possible to defeat Microsoft® Windows® XP SP2 Heap protection and Data Execution Prevention mechanism."

This is too much time to fix something. I can agree with some delayed disclosure but not anything above a month.

Re:This is way wrong.

[jschottm]

This is too much time to fix something. I can agree with some delayed disclosure but not anything above a month.

The CNET article states that they didn't report it to Microsoft until Dec 22. Which is close enough to the holidays that a substantial part of many businesses staff are out until the 1st of Jan.

Anything that modifies core memory access/rights such as this needs extensive testing. It's most likely an easy fix, but you should be well aware of the outrage that would occur if they released a fix that ended up breaking things. Recall the rushed fix to OpenSSH that was distributed only to be replaced days later with a proper fix, leading to all manner of confusion as to which versions were vulnerable and not?

Given that this is a relatively minor problem - the attacker would have to have another sucessful attack vector to be able to use this, I'm glad Microsoft is [theoretically] taking the time to do this right. If you're really that worried about it, you can run the software provided by a mostly unknown Russian company that they freely admit will affect the system negatively. And pray that there's no bugs in their code and that it's not malicious...

It shouldn't be a suprise.

[TeeJS]

that it's easier to bypass a patch over a hole, than get through a barrier that was built solidly from the beginning. I have a mental image of a steel door with a big piece of cardboard taped to it....

Re:It shouldn't be a suprise.

[ZorbaTHut]

I disagree. Refactoring sounds like a much better solution. And I highly doubt this is a serious bug that affects the whole design - why would the introduction of a new CPU flag require the complete reconstruction of an entire OS kernel? Or more?

I don't see how you could possibly suggest a full redesign and rewrite and then, in the same post, complain that fast fixes are rarely 100% correct. As if the rewrite won't be a thousand times worse!

Re:And this

[archen]

I'm surprised about the reporting that SP2 has been "foiled". SP2 is supposed to be a step to make xp more secure, not invincible. There's a lot more to SP2 than the heap protection.

Re:And this

[Anonymous Coward]

I'm shocked! I have been reading all these independent studies, and according to Forrester, Windows users have fewer vulnerabilities. Check it out yourself, if you don't believe!
http://www.microsoft.com/windowsserversy stem/facts /analyses/default.mspx#EHAA

It's a fact. So this vulnerability, and the dozen others I've been patching at the work, are just some kind of imagination. Or maybe Linux / BSD / OS X users have just amazing amounts of vulnerabilities (counted together, OS & apps).

I'm drunk. And it's not a surprise. Every hardcore Linux geek (like myself), who has to maintain Windows networks for living, have more drinking problems than those who are using solely operating systems and software which are free as speech (as opposed to beer).

Responsible for security of Windows network? Next recommendation for security enhancements: different operating systems, no more IE. If there are costs, then they're definitely worth it. Microsoft has proved that they don't care. All they care is money, monopoly and marketing (FUD / brainwashing / propaganda).

I wonder....

[futuresheep]

I wonder what Nick McGrath's opinion on this is, and who is HE holding accountable?

Re:Is that link to MS correct

[DarkMantle]

You expect the links and the article to be related?

You expect too much from the editors.

Re:In hardware?

[Anonymous Coward]

How many of these rely on the hardware to protect them?

Ummm... all of them?

Memory protection requires hardware support to work, and every version of UNIX, Linux, NT (right from the beginning) and Win9x all use hardware support to implement memory protection.

It seems that you have hardware memory protection mixed up with the NX (no execute) bit. All that the NX bit does is nothing more than mark memory allocated on the heap as non executable. The application is completely free to allocate executable memory, just that a normal malloc() does not cut it for this purpose.

This is a very good feature. The reason is that 99.99% of apps never need to execute code created on the heap. The only exceptions are things that JIT code like the Java VM.

Many buffer overruns that result in exploits rely on heap memory being executable. By requiring a very small set of programs to be fixed, you can eliminate a whole type of security flaw. Is it the be all and end all? No its not. But it sure helps.

Re:Linux/NX/AMD64

[DaHat]

Last I checked it already was.

http://news.zdnet.com/2100-3513_22-5227102.html/
http://linuxgazette.net/107/pramode.html/
http://kerneltrap.org/node/3240?PHPSESSID=262a094f ee677def32a8cc4d1b858f99/
http://searchenterpriselinux.techtarget.com/origin alContent/0,289142,sid39_gci969248,00.html/

Just to name a few

And yet

[HackNack]

When asked about the problem Steve Ballmer said that Linux sucks.

foiled?

[gardyloo]

CNET reports that SP2 has been foiled.

Shouldn't that read tin-foiled? C'mon, slashdot, standards?

Re:SP2 what?

[ozbird]

To take the analogy further, does that make Linux the morning-after pill?

Re:And this

[ScrewMaster]

Yeah. A bit sensationalist, I suppose. And SP2 did live up to the ideal of making Windows more secure, but the typical user mentality operates more in the realm of absolutes. "I want perfect security, and SP2 isn't perfect so therefore it's useless." Good security is a process, a continuing evolution, and that's true no matter what OS you use. Would I plug an XP SP2 box right into my cable modem? Not unless I was setting up a honeypot. But it is an improvement.

Fixed Quickly?

[EventHorizon]

The patch may be quick. It will still take a long time to deploy.

Anyway you have to wonder about this kind of technical oversight. If you are implementing an NX heap, you obviously need to NX the WHOLE heap for it to be useful.

Basically it looks like Microsoft is incapable of secure development at the core OS layer. I find that absolutely mind boggling given their resources.

Re:Fixed Quickly?

[peasleer]

Don't make it sound like Linux is problem free either. Just this morning, *11* Linux kernel vulnerabilities were posted to security focus. Yes, the number of vulnerabilities in Linux have historically been fewer in number, but no operating system is perfect. Windows does what it does well: Providing a stable (yes, XP is stable,) operating environment for beginning to advanced users.

Re:Fixed Quickly?

[TelJanin]

And how long will it take to fix the Linux problems, compared to the Windows problem descibed in the article?

Linux way of fixing things:
1) Discover there is a problem
2) Send a patch to kernel maintainers
3) Kernel is patched

Windows way of fixing things:
1) Discover problem
2) Tell Microsoft
3) Two months later, when Microsoft has done nothing, tell the world
4) Get possibly sued by Microsoft (if MS can to a Russian company)
5) After several viruses have exploited the vulnerability, Microsoft makes a patch that won't install correctly.

plus, there's a chicken-and-egg impediment

[js7a]

I don't think Windows users should lose too much sleep over this. How is an exploit supposed to unprotect the heap segment in order to execute the buffer overrun code -- before such code has been executed?

Re:plus, there's a chicken-and-egg impediment

[LO0G]

Exactly: In order to exploit this, you need to find a program with:

1) An exploitable memory overwrite error in a system component.
2) A heap allocation pattern that exactly matches the pattern demonstrated here.

If you don't have BOTH of these criteria met, then it won't matter.

Software DEP was never intended as anything more than a really big speedbump.

As a PoC, it's interesting, but as "the end of XP SP2?" I don't think so....

I blogged another way too

[bluefoxlucid]

I did blog on another way using only a stack overflow on my blog. My way was more "all existing exploits work as-is after just a little extra step" than "exploits still exist that get around DEP" though.

My way was to just slap DEP in the face by using a ret2libc with a constructed stack frame that gave the shellcode a nice, clean, executable area of memory to execute in, then copied the memory there, then returned to it. This is done by 1) Return to VirtualAlloc(), 2) Return to memcpy(), 3) return to shellcode.

They noticed this in October; it took me until January and I'm not a security expert.

For the geeks...

[Jugalator]

... the juicy bits are here. Scroll down to the bottom for the appendices where there are C code examples on how to bypass these measures.

Re:And this

[louarnkoz]

Code execution protection is one of the security features of XP/SP2. The design concept in XP/SP2 is to have a succession of protection layers, e.g. running the firewall to block ports, requiring authentications on RPC ports that are open, blocking some form of communications, etc. None of these protections is entirely foolproof: some ports will remain open, some passwords will be guessed, etc. But it is much harder for an attacker to breach several protections than just one.

The code execution protection is one of these protection layers, pretty much the last one when everything else has been breached and a buffer has overflown. It prevents the class of exploits that load code in a data buffer and somehow jump into it. But there is still a way through, using a stack overflow to rewrite a return pointer or a function pointer and direct it to an existing procedure, e.g. one in libc.

Protecting against such exploits is very hard, and the problem is by no means specific to Windows. Don't expect a quick fix.

Re:An agrarian view on alternatives for XP SP2

[bluefoxlucid]

BSD is under the BSD license. You may rewrite it, steal their code, and not give it out.

You can build things with GCC and not GPL them.

You can build things and link to libraries that are GPL and not GPL them.

So, you can develope apps for linux, using only your own code and any code that BSD people threw under the BSD license, and build them against open source libraries to use those, and have an MS style EULA and closed source.

Incorrect

[Mark_MF-WN]

He compared it to the morning after pill. The morning after pill doesn't "abort" anything -- it simply causes the egg to fail to implant itself in the uterus. This is EXACTLY what IUDs and "The Pill" do, and what happens in 90% of all fertilizations anyway. The morning after pill is just interventive birth-control. It has absolutely nothing to do with abortions.

Re:SP2 what?

[wxjones]

Actually, running Linux is like wearing a plaid hat with earflaps. Best birth control known to man! Come to think of it, its Saturday night and I'm posting on slashdot...using Linux. At least my ears are warm.