Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-28 18:15:11 +00:00
Code Issues Projects Releases Packages Wiki Activity

[NTOS:SE] Assign the captured privilege or SID as NULL when releasing

Browse source 
Whenever a captured security property such as privilege or SID is released, we must not have such captured property point at random address in memory but rather we must assign it as NULL after it's been freed from pool memory. This avoids potential double-after-free situations where we might release a buffer twice.
This is exactly the case with token filtering.
This commit is contained in:
George Bișoc 2022-02-09 10:29:56 +01:00
parent 3ed22ed326
commit 8479509a7b
No known key found for this signature in database
GPG key ID: 49452AAF629C81F3
3 changed files with 3 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
ntoskrnl/se/priv.c
View file

@ -562,6 +562,7 @@ SeReleaseLuidAndAttributesArray(
(PreviousMode != KernelMode || CaptureIfKernel))
{
ExFreePoolWithTag(Privilege, TAG_LUID);
Privilege = NULL;
}
}

1
ntoskrnl/se/sid.c
View file

@ -776,6 +776,7 @@ SeReleaseSidAndAttributesArray(
((AccessMode != KernelMode) || CaptureIfKernel))
{
ExFreePoolWithTag(CapturedSidAndAttributes, TAG_SID_AND_ATTRIBUTES);
CapturedSidAndAttributes = NULL;
}
}

8
ntoskrnl/se/token.c
View file

@ -3,7 +3,7 @@
* LICENSE: GPL-2.0-or-later (https://spdx.org/licenses/GPL-2.0-or-later)
* PURPOSE: Security token implementation support
* COPYRIGHT: Copyright David Welch <welch@cwcom.net>
* Copyright 2021 George Bișoc <george.bisoc@reactos.org>
* Copyright 2021-2022 George Bișoc <george.bisoc@reactos.org>
*/
/* INCLUDES *******************************************************************/
@ -6819,8 +6819,6 @@ Quit:
SeReleaseSidAndAttributesArray(CapturedSids,
PreviousMode,
TRUE);
CapturedSids = NULL;
}
if (CapturedPrivileges != NULL)
@ -6828,8 +6826,6 @@ Quit:
SeReleaseLuidAndAttributesArray(CapturedPrivileges,
PreviousMode,
TRUE);
CapturedPrivileges = NULL;
}
if (CapturedRestrictedSids != NULL)
@ -6837,8 +6833,6 @@ Quit:
SeReleaseSidAndAttributesArray(CapturedRestrictedSids,
PreviousMode,
TRUE);
CapturedRestrictedSids = NULL;
}
return Status;