mirror of
https://github.com/reactos/reactos.git
synced 2024-06-30 09:50:07 +00:00
8e2fe925f2
As it currently stands the PsImpersonateClient routine does the following approach. If impersonation couldn't be granted to a client the routine will make a copy of the client's access token. As it makes a copy of the said token PsImpersonateClient will reference the copied token after impersonation info have been filled out. In the same code path we are assigning the desired level for impersonation to thread impersonation info. This is wrong for two reasons: - On a copy situation the SeCopyClientToken routine holds a reference as the object has been created. Referencing it at the bottom of the PsImpersonateClient routine will make it that the token is referenced twice and whenever a server stops impersonation the token still has an extra reference count which keeps the token still alive in object database and memory space. - If client impersonation is not possible the thread impersonation info should have been assigned SecurityIdentification level to further indicate that the actual impersonation of the thread is not currently in force but instead we are assigning the impersonation level that is supplied by the caller. For instance if the requested level is SecurityDelegation but impersonation is not possible the level will be assigned that of SecurityDelegation yet the token has an impersonation level of SecurityIdentification. This could lead to erratic behaviors as well as potential impersonation escalation. Fix the aforementioned issues by avoiding a double reference and properly assign the impersonation level to SecurityIdentification if the server is not able to impersonate the target client. |
||
|---|---|---|
| .. | ||
| amd64 | ||
| arm | ||
| i386 | ||
| apphelp.c | ||
| debug.c | ||
| job.c | ||
| kill.c | ||
| process.c | ||
| psmgr.c | ||
| psnotify.c | ||
| query.c | ||
| quota.c | ||
| security.c | ||
| state.c | ||
| thread.c | ||
| win32.c | ||