Regarding Microsoft srv2.sys SMB2.0 NEGOTIATE BSOD

[Reversemode <advisories@xxxxxxxxxxxxxxx>]

-----------------------
References:
[Original Advisory ] Lauren Gaffié
http://g-laurent.blogspot.com/2009/09/windows-vista7-smb20-negotiate-protocol.html
-----------------------

Hi all,

Just for the records since the vulnerability is not only a DoS as stated
initially. Below are the technical details I found while verifying the flaw.

* This vulnerability is not only a BSOD flaw. It allows remote code
execution. The execution of code is far from being reliable though (at
the momment).

The flaw is a out-of-bounds indexing. We can fully control the 16 bit
value used as index within the function table.

----------------------
srv2.sys (Vista)

text:000156B3 loc_156B3: ; CODE XREF: Smb2ValidateProviderCallback(x)+4D5j
.text:000156B3                                         ;
Smb2ValidateProviderCallback(x)+4DEj
.text:000156B3  movzx   eax, word ptr [esi+0Ch];
packet->SBM_Header->Process_ID_High
.text:000156B7  mov     eax, _ValidateRoutines[eax*4];          
                        BUG - out-of-bounds dereference.
.text:000156BE  test    eax, eax
.text:000156C0  jnz     short loc_156C9
.text:000156C2  mov     eax, 0C0000002h
.text:000156C7  jmp     short loc_156CC
.text:000156C9 ; —————————————————————————
.text:000156C9
.text:000156C9 loc_156C9:  ; CODE XREF:
Smb2ValidateProviderCallback(x)+4F3j
.text:000156C9  push    ebx
.text:000156CA  call    eax ; Smb2ValidateNegotiate(x) ;
Smb2ValidateNegotiate(x) - KABOOOM!!

-----------------------

* The exploit provided by Lauren Gaffié ( the researcher who discovered
the flaw ) may or may not work since it is based on dereferencing a
non-paged memory page. If the original exploit didn't work, it would
probably deferenced a zeroed memory. You can try ProcessIDHigh values >
0x13 since any of these should trigger the flaw.

Affected versions: Windows Vista - Windows 7 - Windows server 2008.

-*---*-

More technical details (english)
http://www.reversemode.com/index.php?option=com_content&task=view&id=64&Itemid=1

Detalles técnicos (castellano)
http://blog.48bits.com/?p=510

Regards,
Rubén.