CVE-2020-1015 UMPS 条件竞争和UAF利用分析

__int64 UmpoRpcLegacyEventRegisterNotification(__int64 a1,                                               __int64 a2,                                               const wchar_t *a3,                                               int a4)

v14 = 0i64;  v4 = a4;  v5 = a3;  v6 = a2;
  // Return if not local client (local RPC only)  if ( !(unsigned int)UmpoIsClientLocal() )    return 5i64;
  // Get some object  v7 = UmpoGetSettingEntry();  // If not NULL  if ( v7 )  {    // Get another object at v7+32    v8 = (__int64 *)(v7 + 32);    // Walk circular linked list until back at head    for ( i = *v8; (__int64 *)i != v8; i = *(_QWORD *)i )    {      // Breaks if object offset 20 == 1 and      // if object offset 24 == a2      if ( *(_DWORD *)(i + 20) == 1 && *(_QWORD *)(i + 24) == v6 )        goto LABEL_11;    }    // If not found set i to 0    i = 0i64;LABEL_11:    // If found within circular linked list set v14 to object pointer    v14 = i;  }

// if a4  if ( v4 )  {   // if section 1 code loop does not find anything i is 0    if ( !i )      return 0i64;    // otherwise unregister    result = UmpoNotifyUnregister(i);  }  // if a4 == 0 (our current case)  else  {    if ( i )      return 0i64;    // Get sessionID of service    v10 = WTSGetServiceSessionId();    // call UmpoNotifyRegister    result = UmpoNotifyRegister(v12, v11, v10, v6, v5, &v14);  }

__int64 UmpoRpcLegacyEventRegisterNotification(   // RPC Binding Handle   __int64 a1,   // Handle   __int64 a2,   // Service Name   const wchar_t *a3,   // 0 to Register 1 to Unregister   int a4)

__int64 __fastcall UmpoNotifyRegister(    // Set to 0     STRSAFE_LPCWSTR pszSrc,    // Set to 0     __int64 a2,    // SessionID    int a3,    // Handle    __int64 a4,    // Service Name    const wchar_t *pszSrca,    // Reference to return to calling function?    __int64 *a6)

v6 = a4;  v7 = a3;  v8 = 0;
  EnterCriticalSection(&UmpoNotification);  if ( service_name )  {    v9 = service_name;    v10 = 256i64;    // walk through string until null char is encountered    // or 256 characters are read    do    {      if ( !*v9 )        break;      ++v9;      --v10;    }    while ( v10 );    // v11 set to error code if error if str len > 256    v11 = v10 == 0 ? 0x80070057 : 0;    if ( v10 )      // v12 set to length of string      v12 = 256 - v10;    else      v12 = 0i64;  }  else  {    v12 = 0i64;    v11 = -2147024809;  }

struct registrant {    // pointer to next    next: usize,    // pointer to prev    prev: usize,    // set to 1 after alloc    count: u32,    // Flags    flags: u32,    // handle we pass    handle: usize,    // heap alloc which is size of service_name + 2 for null char    service_name: usize,    // sessionID    session_id: u32,    // unknown, might be two u16s    unknown: u32,}

// if no error on service_name length check if ( !v11 )  {    v13 = (_QWORD *)UmpoGetSettingEntry();    v11 = 8;    ...    // allocate registrant struct memory 48 bytes    v14 = RtlAllocateHeap(UmpoHeapHandle, 8i64, 48i64);    v15 = v14;
    // error case on alloc    if ( !v14 )      goto LABEL_20;
    v16 = UmpoHeapHandle;    // r->count is set to 1    *(_DWORD *)(v14 + 16) = 1;    // r->prev is set to itself    *(_QWORD *)(v14 + 8) = v14;    // r->next is set to itself    *(_QWORD *)v14 = v14;    // allocate memory for r->service_name    v17 = (wchar_t *)RtlAllocateHeap(v16, 8i64, (unsigned int)(2 * v12 + 2));    // set r->service_name pointer to allocated memory    *(_QWORD *)(v15 + 32) = v17;
    // error case on alloc    if ( !v17 )    {LABEL_18:      if ( v15 )        UmpoDereferenceRegistrant((__int64 *)v15);LABEL_20:      if ( v13 && v8 )        RtlFreeHeap(UmpoHeapHandle, 0i64);      goto LABEL_21;    }
    // set r->flags set to 1    *(_DWORD *)(v15 + 20) = 1;    // set r->handle to a4 (handle)    *(_QWORD *)(v15 + 24) = v6;    // copy func arg service_name into r->service_name    StringCchCopyW(v17, v12 + 1, pszSrca);    // umpo!UmpoNotifyRegister+0x111: lea rax, [rsi+20h]    v18 = v13 + 4;    // set r->session_id    *(_DWORD *)(v15 + 40) = v7;    // v19 = settingEntry head->next    v19 = v13[4];    // check if linked list head->next->prev == head    if ( *(_QWORD **)(v19 + 8) == v13 + 4 )    {      // inserting at head of list      // set r->next to head->next      *(_QWORD *)v15 = v19;      // set r->prev to head      *(_QWORD *)(v15 + 8) = v18;      // set head->next->prev to r      *(_QWORD *)(v19 + 8) = v15;      // set head->next to r      *v18 = v15;      // set r+44 to 0      *(_BYTE *)(v15 + 44) = 0;

Thread 1 enters UmpoRpcLegacyEventRegisterNotication.Thread 1 accesses linked list registrant shared object.Thread 1 obtains pointer to target registrant struct.Thread 1 enters UmpoNotifyUnregister.Thread 2 enters UmpoRpcLegacyEventRegisterNotication.Thread 1 enters UmpoDereferenceRegistrant.Thread 2 accesses linked list registrant shared object.Thread 2 obtains pointer to target registrant struct.Thread 1 frees registrant struct memory.

HRESULT UmpoRpcLegacyEventRegisterNotification(    /* Stack Offset: 0 */ handle_t p0,    /* Stack Offset: 8 */ [In] UIntPtr p0,    /* Stack Offset: 16 */ [In] /* FC_SUPPLEMENT FC_C_WSTRING Range(0, 256) */    wchar_t* p1,    /* Stack Offset: 24 */ [In] int p2);