Windows VDM零页面竞争条件本地特权提升漏洞

Microsoft Windows是一款商业性质的操作系统。 Windows内核在实现虚拟DOS机(VDM)时存在竞争条件错误，本地攻击者可以利用漏洞提升特权。 在初始化VDM过程中，NtVdmControl(3)调用NT!VdmpInitialize拷贝零页面内容到虚拟地址0，因此VDM就复制了系统的原始中断向量表(IVT)和BIOS数据域的副本。要完成这个操作，VdmpInitialize使用SECTION_ALL_ACCESS打开\Device\PhysicalMemory，然后映射扇区的开始4KB，之后这个映射memmove到虚拟地址0，如果出现异常事件会废除映射并中断函数；如果memmove操作成功实现也会立即解除映射。 但物理内存以PAGE_READWRITE权限映射到用户地址空间中的，因此恶意线程可在解除映射之前重新执行，然后通过写映射直接修改零页面。虽然竞争条件的机会窗口很小，而且映射基址是动态的，VdmpInitialize在每个进程中也只能成功执行一次，不过本地登录的用户还是对有机会获得对系统的完全控制。 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 0 Microsoft Windows Server 2003 Web Edition SP2 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows 2000 Terminal Services SP4 + Microsoft Windows 2000 Advanced Server SP4 + Microsoft Windows 2000 Datacenter Server SP4 + Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Terminal Services SP3 + Microsoft Windows 2000 Advanced Server SP3 + Microsoft Windows 2000 Datacenter Server SP3 + Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Terminal Services SP2 + Microsoft Windows 2000 Advanced Server SP2 + Microsoft Windows 2000 Datacenter Server SP2 + Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Terminal Services SP1 + Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Datacenter Server SP1 + Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Terminal Services + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Datacenter Server + Microsoft Windows 2000 Server Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server + Avaya S8100 Media Servers Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server Microsoft Windows Server 2003 Datacenter Edition SP1 * Microsoft Security Update for Windows Server 2003 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0</a> -4459-92eb-d43b524fd6fd&amp;displaylang=en Microsoft Windows Server 2003 Enterprise Edition SP1 * Microsoft Security Update for Windows Server 2003 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0</a> -4459-92eb-d43b524fd6fd&amp;displaylang=en Microsoft Windows XP Media Center Edition SP2 * Microsoft Security Update for Windows XP (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=eeaee4a7-4858" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=eeaee4a7-4858</a> -4b6b-9c6d-a9f1eae19b51&amp;displaylang=en Microsoft Windows Server 2003 Datacenter Edition * Microsoft Security Update for Windows Server 2003 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0</a> -4459-92eb-d43b524fd6fd&amp;displaylang=en Microsoft Windows 2000 Advanced Server SP4 * Microsoft Security Update for Windows 2000 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=b3599afb-7673" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=b3599afb-7673</a> -4ef6-a2b1-d77e39fd782c&amp;displaylang=en Microsoft Windows Server 2003 Enterprise Edition * Microsoft Security Update for Windows Server 2003 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0</a> -4459-92eb-d43b524fd6fd&amp;displaylang=en Microsoft Windows 2000 Terminal Services SP4 * Microsoft Security Update for Windows 2000 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=b3599afb-7673" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=b3599afb-7673</a> -4ef6-a2b1-d77e39fd782c&amp;displaylang=en Microsoft Windows Server 2003 Standard Edition SP2 * Microsoft Security Update for Windows Server 2003 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0</a> -4459-92eb-d43b524fd6fd&amp;displaylang=en Microsoft Windows XP Home SP2 * Microsoft Security Update for Windows XP (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=eeaee4a7-4858" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=eeaee4a7-4858</a> -4b6b-9c6d-a9f1eae19b51&amp;displaylang=en Microsoft Windows 2000 Datacenter Server SP4 * Microsoft Security Update for Windows 2000 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=b3599afb-7673" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=b3599afb-7673</a> -4ef6-a2b1-d77e39fd782c&amp;displaylang=en Microsoft Windows XP Tablet PC Edition SP2 * Microsoft Security Update for Windows XP (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=eeaee4a7-4858" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=eeaee4a7-4858</a> -4b6b-9c6d-a9f1eae19b51&amp;displaylang=en Microsoft Windows Server 2003 Web Edition SP2 * Microsoft Security Update for Windows Server 2003 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0</a> -4459-92eb-d43b524fd6fd&amp;displaylang=en Microsoft Windows Server 2003 Standard Edition SP1 * Microsoft Security Update for Windows Server 2003 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0</a> -4459-92eb-d43b524fd6fd&amp;displaylang=en Microsoft Windows Server 2003 Standard Edition * Microsoft Security Update for Windows Server 2003 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=5e94a29c-7ec0</a> -4459-92eb-d43b524fd6fd&amp;displaylang=en Microsoft Windows XP Professional SP2 * Microsoft Security Update for Windows XP (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=eeaee4a7-4858" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=eeaee4a7-4858</a> -4b6b-9c6d-a9f1eae19b51&amp;displaylang=en Microsoft Windows 2000 Server SP4 * Microsoft Security Update for Windows 2000 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=b3599afb-7673" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=b3599afb-7673</a> -4ef6-a2b1-d77e39fd782c&amp;displaylang=en Microsoft Windows 2000 Professional SP4 * Microsoft Security Update for Windows 2000 (KB931784) <a href="http://www.microsoft.com/downloads/details.aspx?familyid=b3599afb-7673" target="_blank">http://www.microsoft.com/downloads/details.aspx?familyid=b3599afb-7673</a> -4ef6-a2b1-d77e39fd782c&amp;displaylang=en