Bugtraq mailing list archives
GDT and LDT in Windows kernel vulnerability exploitation (paper)
From: Gynvael Coldwind <gynvael () coldwind pl>
Date: Sun, 17 Jan 2010 01:53:48 +0100
Hi, We've published a paper about using 1 or 4 byte write-what-where condition to convert a custom Data-Segment Descriptor entry in LDT of a process into a Call-Gate (with DPL set to 3 and RPL to 0). The paper also contains information about a possible LDT redirecting into user-land memory. The paper is Windows NT family (starting from Windows 2000 and XP) and x86 protected mode specific. The paper DOES NOT contain information about new or old vulnerabilities. It only proposes a way to convert a potential write-what-where vulnerability into code execution, in a stable manner. http://vexillium.org/dl.php?call_gate_exploitation.pdf More information is available on our blogs: http://gynvael.coldwind.pl/?id=274 http://j00ru.vexillium.org/?p=290&lang=en Comments are welcomed :) Take care, -- gynvael.coldwind//vx and j00ru//vx
Current thread:
- GDT and LDT in Windows kernel vulnerability exploitation (paper) Gynvael Coldwind (Jan 18)