reactos/ntoskrnl/ps
George Bișoc 8e2fe925f2
[NTOS:PS] Do not reference the copied token twice and properly assign the impersonation level in case the server can't impersonate
As it currently stands the PsImpersonateClient routine does the following approach.
If impersonation couldn't be granted to a client the routine will make a copy
of the client's access token. As it makes a copy of the said token PsImpersonateClient
will reference the copied token after impersonation info have been filled out.
In the same code path we are assigning the desired level for impersonation to thread
impersonation info.

This is wrong for two reasons:

- On a copy situation the SeCopyClientToken routine holds a reference as the object
has been created. Referencing it at the bottom of the PsImpersonateClient routine
will make it that the token is referenced twice and whenever a server stops
impersonation the token still has an extra reference count which keeps the token
still alive in object database and memory space.

- If client impersonation is not possible the thread impersonation info should
have been assigned SecurityIdentification level to further indicate that the
actual impersonation of the thread is not currently in force but instead we
are assigning the impersonation level that is supplied by the caller. For instance
if the requested level is SecurityDelegation but impersonation is not possible
the level will be assigned that of SecurityDelegation yet the token has an
impersonation level of SecurityIdentification. This could lead to erratic behaviors
as well as potential impersonation escalation.

Fix the aforementioned issues by avoiding a double reference and properly assign
the impersonation level to SecurityIdentification if the server is not able to
impersonate the target client.
2023-06-09 11:53:55 +02:00
..
amd64 [FORMATTING][NTOS][HAL][DRIVERS][SDK] Fix trailing spaces 2021-06-11 15:33:08 +03:00
arm [FORMATTING][NTOS][HAL][DRIVERS][SDK] Fix trailing spaces 2021-06-11 15:33:08 +03:00
i386 [NTOSKRNL] Regroup the pool allocation tags in one dedicated place 2021-12-27 18:57:03 +01:00
apphelp.c [NTOSKRNL] Regroup the pool allocation tags in one dedicated place 2021-12-27 18:57:03 +01:00
debug.c [REACTOS] Fix some instances of DPRINTs with trailing whitespace before newlines. 2021-09-13 03:52:19 +02:00
job.c [NTOS:PS] Fix copypasta in NtQueryInformationJobObject. CID 1441354 2021-11-13 21:23:40 -05:00
kill.c [KERNEL32][NTOS:PS][RTL] Cleanup some DbgPrompt() calls. 2023-01-06 14:44:49 +01:00
process.c [NTOSKRNL][NDK] Get rid of SECTION_OBJECT typedef 2021-02-03 09:41:21 +01:00
psmgr.c [REACTOS] Cleanup INIT and some PAGE section allocations 2020-11-02 21:45:31 +03:00
psnotify.c
query.c [NTOSKRNL] Force a probe against ReturnLength on query & Misc ICIF stuff 2022-06-12 11:05:05 +02:00
quota.c [NTOS:PS] Process Quota Overhaul 2022-01-11 10:11:09 +01:00
security.c [NTOS:PS] Do not reference the copied token twice and properly assign the impersonation level in case the server can't impersonate 2023-06-09 11:53:55 +02:00
state.c [FORMATTING][NTOS][HAL][DRIVERS][SDK] Fix trailing spaces 2021-06-11 15:33:08 +03:00
thread.c [CSRSRV][NTOS:PS] Misc typos fixes. 2022-11-14 00:10:30 +01:00
win32.c