CVE:CVE-2009-1146
CNNVD:CNNVD-200904-107
VMWare是一款虚拟PC软件，允许在一台机器上同时运行两个或多个Windows、DOS、LINUX系统。
VMWare的hcmon.sys驱动没有过滤用户态通过METHOD_NEITHER发送的指针：
.text:00011606 loc_11606:  
.text:00011606                 mov     eax, [ebp+SystemBuffer]
.text:00011609                 mov     [ebp+SystemBuffer2], eax
.text:0001160C                 mov     ecx, [ebp+SystemBuffer2]
.text:0001160F                 mov     edx, [ecx+0Ch]       <---- BUGCHECK
.text:00011612                 cmp     edx, [ebp+var_20]
.text:00011615                 jnz     short loc_11629
.text:00011617                 cmp     [ebp+NumberOfBytes], 70h
.text:0001161B                 jb      short loc_11629
.text:0001161D                 mov     eax, [ebp+SystemBuffer2]
.text:00011620                 cmp     dword ptr [eax+8], 7FFBh
.text:00011627                 jbe     short loc_11638
如果本地用户向\\.\hcmon设备发送了0x8101232B IOCTL，就可以导致内核崩溃。
solution:Upgrade vmware ace to a higher version than 2.5.1,1.0,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,2.0,2.0.1,2.0.2,2.0.3,2.0.4,2.0.5,2.5.0,and avoid the version (,2.5.1],1.0,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,2.0,2.0.1,2.0.2,2.0.3,2.0.4,2.0.5,2.5.0; Upgrade vmware player to a higher version than 2.5.1,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,2.0,2.0.1,2.0.2,2.0.3,2.0.4,2.0.5,2.5,and avoid the version (,2.5.1],1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,2.0,2.0.1,2.0.2,2.0.3,2.0.4,2.0.5,2.5; Upgrade vmware server to a higher version than 1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,2.0,and avoid the version 1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,2.0; Upgrade vmware workstation to a higher version than 6.5.1,1.0.1,1.0.2,1.0.4,1.0.5,1.1,1.1.1,1.1.2,2.0,2.0.1,3.2.1:patch1,3.4,4.0,4.0.1,4.0.2,4.5.2,5,5.5,5.5.1,5.5.2,5.5.3,5.5.4,5.5.5,5.5.6,5.5.7,5.5.8,6.0,6.0.1,6.0.2,6.0.3,6.0.4,6.0.5,6.5,and avoid the version (,6.5.1],1.0.1,1.0.2,1.0.4,1.0.5,1.1,1.1.1,1.1.2,2.0,2.0.1,3.2.1:patch1,3.4,4.0,4.0.1,4.0.2,4.5.2,5,5.5,5.5.1,5.5.2,5.5.3,5.5.4,5.5.5,5.5.6,5.5.7,5.5.8,6.0,6.0.1,6.0.2,6.0.3,6.0.4,6.0.5,6.5