{"uuid": "8969a552-cb3f-49d9-8767-7a23f4242af4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-29360", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/117539", "content": "Kali Linux Tutorials\nCVE-2023-29360: Kernel DMA Exploit For Direct R/W Access To kernel Virtual Memory\n\nWhen looking for vulnerabilities of interest, it\u2019s always a good option to look for vulnerabilities used at pwn2own. Indeed, these vulnerabilities are exploited during the competition, meaning they have a practical impact. \n\n* Thomas is recognized as one of the several highly skilled researchers in the French exploit scene, and is certainly knowledgeable\n* The vulnerability, teased in the HITB\u2019s upcoming conference, is described as:\u00a0\u201ca logical bug that defeats most mitigations by allowing direct read and write access to kernel virtual memory.\u201d Finding The Root Cause Starting with the ZDI\u2019s advisory\u00a0of the vulnerability, it is possible to get enough details to look for the root cause. Typically, the important information is:\n\n* The vulnerability is present in the mskssrvdriver\n* The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer\n\nThe next step is to patch-diff the driver for the update, correcting the vulnerability. Only one function\u2014named FsAllocAndLockMdl\u2014was modified. \n\nWithin that function, the AccessModeparameter of the call to MmProbeAndLockPageswas changed from KernelModeto UserMode, as shown in the following Screenshot:\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdRLaYtJj9wv-e-vvB97gZiwedwqJWle8TigXqfpwdJqF89d9ibixP_JjPUXTAn4LeCQg8-X2NS31i-BTkp-eIA1Yif1SUQfRmOIRM026jwe5sclDbYDq4RRpIXWYxAx6b-lNX2pQAWTDop0SVeO6Z3S9HsLBew3TXYwarS7bUWSJWzgW9rjeFPclPkTKf/s16000/diff.png \n\nWith the root cause found, let\u2019s analyze the vulnerability. Understanding The Vulnerability MDL, What is that? An I/O buffer that occupies a contiguous virtual memory range can be non-contiguously distributed over several physical pages in memory. \n\nThe Windows OS utilizes memory descriptor list(MDL) structures at the kernel level to describe a single virtual memory buffer\u2019s physical page layout. \n\nMDLs vary in size, are semi-opaque, and are composed of a header that describes the MDL\u2019s properties and a variable-size array of pointers\u2014called the page frame number(PFN) array\u2014describing the physical addresses used by the MDL. \n\nInside the header, the virtual address (VA) of the memory buffer that is physically described by the MDL is present, as well as its length.\n\nThe following schematics illustrates the concept of MDL:\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHhez6VB4HNsrBpmNbQhgWnpQ2T3ZwZyroY2byfU83PWx7fXXTGbt-UvbVIqnjVPoGFzKGA4v6djQWjRDaiORzGIVpLemcOuqBM966WBePgkuGoe1iYYEI2QQZF5sTGepwFI-oUtBKtD-c5cEz2afo6tuGWBIFlhtx5XcFHTG1KVkalJILgRH435qi_Z7J/s16000/mdl.webp \n\nMDL creation and interaction are reserved for the components operating in kernel mode, like drivers, even though a user-facing process may be able to do so via a communication channel with a driver.\n\nIt should be noted that an address that is already mapped and potentially in use by the OS can have its physical page layout described by a new MDL. \n\nIn this case, the component accessing this MDL will be able\u00a0(overly simplified) to directly access the physical memory pointed to by this buffer VA. \n\nThis creates a communication channel between this component and the OS component that is already interacting with the VA.\n\nAs a consequence, MDLs can allow drivers for the Windows OS to implement Direct Memory Access (DMA) operations and permit memory-copy operations between the user land and the kernel land (Direct I/O). Inner Workings of IoAllocateMdl and MmProbeAndLockPages In the vulnerable functionFsAllocAndLockMdl, two APIs permitting interaction with MDLs are used: IoAllocateMdland MmProbeAndLockPages.\n\nThe first API\u2014IoAllocateMdl\u2014allocates the MDL str[...]", "creation_timestamp": "2026-09-05T01:00:34.438229Z"}