{"action":"created","issue":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/128","labels_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/128/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/128/comments","events_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/128/events","html_url":"https://github.com/chrsmith/google-security-research/issues/128","id":58936883,"number":128,"title":"Windows: Impersonation Check Bypass With CryptProtectMemory and CRYPTPROTECTMEMORY_SAME_LOGON flag","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CCProjectZeroMembers","name":"CCProjectZeroMembers","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CVE-2015-0010","name":"CVE-2015-0010","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-90","name":"Deadline-90","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-Exceeded","name":"Deadline-Exceeded","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Finder-forshaw","name":"Finder-forshaw","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Fixed-2015-Feb-10","name":"Fixed-2015-Feb-10","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/MSRC-20707","name":"MSRC-20707","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Product-Windows-Kernel","name":"Product-Windows-Kernel","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/PublicOn-2015-Jan-15","name":"PublicOn-2015-Jan-15","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Reported-2014-Oct-17","name":"Reported-2014-Oct-17","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Severity-Medium","name":"Severity-Medium","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Vendor-Microsoft","name":"Vendor-Microsoft","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-02-25T17:16:02Z","updated_at":"2015-02-25T17:16:04Z","closed_at":"2015-02-25T17:16:02Z","body":"```\nPlatform: Windows 7, 8.1 Update 32/64 bit\nClass: Security Bypass/Information Disclosure\n\nThe function CryptProtectMemory allows an application to encrypt memory for one \nof three scenarios, process, logon session and computer. When using the logon \nsession option (CRYPTPROTECTMEMORY_SAME_LOGON flag) the encryption key is \ngenerated based on the logon session identifier, this is for sharing memory \nbetween processes running within the same logon. As this might also be used for \nsending data from one process to another it supports extracting the logon \nsession id from the impersonation token. \n\nThe issue is the implementation in CNG.sys doesn't check the impersonation \nlevel of the token when capturing the logon session id (using \nSeQueryAuthenticationIdToken) so a normal user can impersonate at \nIdentification level and decrypt or encrypt data for that logon session. This \nmight be an issue if there's a service which is vulnerable to a named pipe \nplanting attack or is storing encrypted data in a world readable shared memory \nsection. \n\nThis behaviour of course might be design, however not having been party to the \ndesign it's hard to tell. The documentation states that the user must \nimpersonate the client, which I read to mean it should be able to act on behalf \nof the client rather than identify as the client.\n\nAttached is a simple PoC which demonstrates the issue. To reproduce follow the \nsteps.\n\n1) Execute Poc_CNGLogonSessionImpersonation.exe from the command line\n2) The program should print \"Encryption doesn't match\" to indicate that the two \nencryptions of the same data was not a match, implying the key was different \nbetween them. \n\nExpected Result:\nBoth calls should return the same encrypt data, or the second call should fail\n\nObserved Result:\nBoth calls succeed and return different encrypted data\n\nThis bug is subject to a 90 day disclosure deadline. If 90 days elapse\nwithout a broadly available patch, then the bug report will automatically\nbecome visible to the public.\n```\n\n-----\nOriginal issue reported on code.google.com by `fors...@google.com` on 17 Oct 2014 at 10:55\n\nAttachments:\n* [Poc_CNGLogonSessionImpersonation.zip](https://storage.googleapis.com/google-code-attachments/google-security-research/issue-128/comment-0/Poc_CNGLogonSessionImpersonation.zip)\n"},"comment":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/comments/76006696","html_url":"https://github.com/chrsmith/google-security-research/issues/128#issuecomment-76006696","issue_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/128","id":76006696,"user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"created_at":"2015-02-25T17:16:04Z","updated_at":"2015-02-25T17:16:04Z","body":"```\nDeadline exceeded - automatically derestricting\n```\n\n-----\nOriginal comment by `haw...@google.com` on 15 Jan 2015 at 8:34\n* Added labels: **Deadline-Exceeded**, **PublicOn-2015-Jan-15**\n* Removed labels: **Restrict-View-Commit**"}}