Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-04-20 20:36:35 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOS:SE] Check the privilege count against the maximum threshold

Browse source 
In SeCaptureLuidAndAttributesArray we must ensure that we don't go onto a potential integer overflow scenario by checking against the maximum limit threshold the kernel states. In addition, write an explicit name macro for the value.
This commit is contained in:
George Bișoc 2021-09-26 11:38:45 +02:00
parent a415bd46b1
commit 199f575342
No known key found for this signature in database
GPG key ID: 688C4FBE25D7DEF6
1 changed files with 10 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
ntoskrnl/se/priv.c
View file

@ -15,6 +15,8 @@
/* GLOBALS ********************************************************************/ /* GLOBALS ********************************************************************/
#define SE_MAXIMUM_PRIVILEGE_LIMIT 0x3C
#define CONST_LUID(x1, x2) {x1, x2} #define CONST_LUID(x1, x2) {x1, x2}
const LUID SeCreateTokenPrivilege = CONST_LUID(SE_CREATE_TOKEN_PRIVILEGE, 0); const LUID SeCreateTokenPrivilege = CONST_LUID(SE_CREATE_TOKEN_PRIVILEGE, 0);
const LUID SeAssignPrimaryTokenPrivilege = CONST_LUID(SE_ASSIGNPRIMARYTOKEN_PRIVILEGE, 0); const LUID SeAssignPrimaryTokenPrivilege = CONST_LUID(SE_ASSIGNPRIMARYTOKEN_PRIVILEGE, 0);
@ -427,7 +429,9 @@ SeCheckAuditPrivilege(
* has been captured successfully. STATUS_INSUFFICIENT_RESOURCES is returned * has been captured successfully. STATUS_INSUFFICIENT_RESOURCES is returned
* if memory pool allocation for the captured buffer has failed. * if memory pool allocation for the captured buffer has failed.
* STATUS_BUFFER_TOO_SMALL is returned if the buffer size is less than the * STATUS_BUFFER_TOO_SMALL is returned if the buffer size is less than the
* required size. * required size. STATUS_INVALID_PARAMETER is returned if the caller has
* submitted a privilege count that exceeds that maximum threshold the
* kernel can permit, for the purpose to avoid an integer overflow.
*/ */
NTSTATUS NTSTATUS
NTAPI NTAPI
@ -454,15 +458,17 @@ SeCaptureLuidAndAttributesArray(
return STATUS_SUCCESS; return STATUS_SUCCESS;
} }
if (PrivilegeCount > SE_MAXIMUM_PRIVILEGE_LIMIT)
{
return STATUS_INVALID_PARAMETER;
}
if (PreviousMode == KernelMode && !CaptureIfKernel) if (PreviousMode == KernelMode && !CaptureIfKernel)
{ {
*Dest = Src; *Dest = Src;
return STATUS_SUCCESS; return STATUS_SUCCESS;
} }
/* FIXME - check PrivilegeCount for a valid number so we don't
cause an integer overflow or exhaust system resources! */
BufferSize = PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES); BufferSize = PrivilegeCount * sizeof(LUID_AND_ATTRIBUTES);
*Length = ROUND_UP(BufferSize, 4); /* round up to a 4 byte alignment */ *Length = ROUND_UP(BufferSize, 4); /* round up to a 4 byte alignment */