{"id":17922,"date":"2020-03-17T20:34:26","date_gmt":"2020-03-18T04:34:26","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2020\/03\/17\/news-11655\/"},"modified":"2020-03-17T20:34:26","modified_gmt":"2020-03-18T04:34:26","slug":"news-11655","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2020\/03\/17\/news-11655\/","title":{"rendered":"CVE-2020-0796 Memory Corruption Vulnerability in Windows 10 SMB Server"},"content":{"rendered":"<div class=\"aem-Grid aem-Grid--12 aem-Grid--default--12\">\n<div class=\"cmp cmp-image aem-GridColumn aem-GridColumn--default--12\">         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p><b><a href=\"https:\/\/fortiguard.com\/\">FortiGuard Labs<\/a>\u00a0Threat Analysis Report<\/b><\/p>\n<p>\u00a0<\/p>\n<\/p><\/div>\n<div class=\"raw-import aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"text-container\">\n<p class=\"MsoNormal\" style=\"margin: 0in 0in 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif; color: #000000; font-style: normal; font-weight: normal; text-align: start; line-height: 18.399999618530273px;\"><span style=\"font-family: Calibri, sans-serif;\">Affected platforms:<\/span><span style=\"font-family: Calibri, sans-serif;\">&nbsp;&nbsp;&nbsp;&nbsp;Windows 10<br \/>Impacted parties: &nbsp; &nbsp; &nbsp; All Windows users&nbsp;<br \/>Impact:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span style=\"font-family: Calibri, sans-serif;\">An unauthenticated attacker can exploit this wormable vulnerability to cause&nbsp;<\/span><span style=\"font-family: Calibri, sans-serif;\">memory corruption, which may &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;lead to remote code execution.&nbsp;<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin: 0in 0in 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif; color: #000000; font-style: normal; font-weight: normal; text-align: start; line-height: 18.399999618530273px;\"><span style=\"font-family: Calibri, sans-serif;\">Severity level:<\/span><span style=\"font-family: Calibri, sans-serif;\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;High<\/span><\/p>\n<p class=\"MsoNormal\" style=\"margin: 0in 0in 0.0001pt; font-size: medium; font-family: 'Times New Roman', serif; color: #000000; font-style: normal; font-weight: normal; text-align: start; line-height: 18.399999618530273px;\"><span style=\"font-family: Calibri, sans-serif;\">Solution:<\/span><span style=\"font-family: Calibri, sans-serif;\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;All Windows 10 users are urged to apply the&nbsp;<\/span><span style=\"font-family: Calibri, sans-serif;\">patch for CVE-2020-0796<\/span><\/p>\n<\/div><\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<h2>Introduction<\/h2>\n<p>Microsoft recently released a patch for <a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-0796\">CVE-2020-0796<\/a>, a critical SMB server vulnerability that affects Windows 10. An unauthenticated attacker can exploit this vulnerability to cause memory corruption, which may lead to remote code execution.<\/p>\n<p>This SMB vulnerability also has the potential to be exploited by worms to spread quickly. In 2017, the WannaCry ransomware exploited SMB server vulnerability CVE-2017-0144, infecting over 200,000 computers and causing billions of dollars in total damages. We urge everyone to patch their Windows 10 computers as soon as possible.<\/p>\n<h2>Affected Versions<\/h2>\n<p>Windows 10 Version 1903 for 32-bit Systems<\/p>\n<p>Windows 10 Version 1903 for x64-based Systems<\/p>\n<p>Windows 10 Version 1903 for ARM64-based Systems<\/p>\n<p>Windows Server, version 1903 (Server Core installation)<\/p>\n<p>Windows 10 Version 1909 for 32-bit Systems<\/p>\n<p>Windows 10 Version 1909 for x64-based Systems<\/p>\n<p>Windows 10 Version 1909 for ARM64-based Systems<\/p>\n<p>Windows Server, version 1909 (Server Core installation)<\/p>\n<h2>Overview<\/h2>\n<p>FortiGuard Labs performed an analysis of this vulnerability on Windows 10 x64 version 1903. This blog post explains how a compressed data packet with a malformed header can cause an integer overflow in the SMB server. This overflow results in the kernel allocating a buffer that&#8217;s far too small to hold the decompressed data, which leads to memory corruption.<\/p>\n<h2>Technical Analysis<\/h2>\n<p>There is an integer overflow bug in the Srv2DecompressData function in srv2.sys. This vulnerability can be triggered when the SMB server receives a malformed <a href=\"https:\/\/docs.microsoft.com\/en-us\/openspecs\/windows_protocols\/ms-smb2\/1d435f21-9a21-4f4c-828e-624a176cf2a0\">SMB2_Compression_Transform_Header<\/a>.\u00a0<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn aem-GridColumn--default--10 aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/cve-2020-0796-memory-corruption-vulnerability-in-windows-10-smb-server\/_jcr_content\/root\/responsivegrid\/image_1295602733.img.png\/1583797263295\/picture1.png\" alt=\"Figure 1: Wireshark capture of a malformed SMB2_Compression_Transform_Header\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 1: Wireshark capture of a malformed SMB2_Compression_Transform_Header<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>In our test, we created a malformed SMB2_Compression_Transform_Header that has an 0xFFFFFFFF (4294967295) OriginalSize\/OriginalCompressedSegmentSize with an 0x64 (100) Offset. The data was compressed using the plain LZ77 algorithm.<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn aem-GridColumn--default--10 aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/cve-2020-0796-memory-corruption-vulnerability-in-windows-10-smb-server\/_jcr_content\/root\/responsivegrid\/image_996825032.img.png\/1583797266234\/picture2.png\" alt=\"Figure 2: IDA screenshot. Large OriginalSize + Offset can trigger an integer overflow in the Srv2DecompressData function in srv2.sys\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 2: IDA screenshot. Large OriginalSize + Offset can trigger an integer overflow in the Srv2DecompressData function in srv2.sys<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>The above screenshot shows where the integer overflow occurs in the Srv2DecompressData function in srv2.sys. This function creates a buffer that holds the decompressed data. The function computes the buffer size by adding the \u201cOriginalSize\u201d to the \u201cOffset\u201d, which can cause an integer overflow in the ECX register. Once it has calculated the buffer size, it passes the size to the SrvNetAllocateBuffer function to allocate the buffer.<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn aem-GridColumn--default--10 aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/cve-2020-0796-memory-corruption-vulnerability-in-windows-10-smb-server\/_jcr_content\/root\/responsivegrid\/image_576320862.img.png\/1583797355486\/picture3.png\" alt=\"Figure 3: Windbg screenshot, before and after the integer overflow\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 3: Windbg screenshot, before and after the integer overflow<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>In the example above, EAX (the lower 8 bytes of RAX) holds the OriginalSize 0xFFFFFFFF and ECX (the lower 8 bytes of RCX) holds the Offset 0x64. The buffer size was calculated as 0xFFFFFFFF + 0x64, which overflowed to 0x63. The function then called SrvNetAllocateBuffer to allocate the buffer at size 0x63 (99) bytes. This overflow caused the kernel to allocate a buffer that was much smaller than intended.<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn aem-GridColumn--default--10 aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/cve-2020-0796-memory-corruption-vulnerability-in-windows-10-smb-server\/_jcr_content\/root\/responsivegrid\/image_130568375.img.png\/1583797372468\/picture4.png\" alt=\"Figure 4: Windbg screenshot, decompress LZ77 data and buffer overflow in the RtlDecompressBufferXpressLz function in ntoskrnl.exe\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 4: Windbg screenshot, decompress LZ77 data and buffer overflow in the RtlDecompressBufferXpressLz function in ntoskrnl.exe<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>Later, the kernel called the RtlDecompressBufferXpressLz function to decompress the LZ77 data. The above screenshot showed that the kernel used the \u201crep movs\u201d instruction to copy 0x15f8f (89999) bytes of data into the buffer with a size that was previously allocated at 0x63 (99) bytes. This overflowed the small buffer, which caused memory corruption and the kernel to crash.<\/p>\n<h2>Conclusion<\/h2>\n<p>In this blog post, we attempted to explain the root cause of the CVE-2020-0796 vulnerability. This SMB memory corruption vulnerability is extremely severe, for there is a possibility that worms might be able to exploit this to infect and spread through a network, similar to how the WannaCry ransomware exploited the SMB server vulnerability in 2017. It is very important that users apply the Windows 10 patch.<\/p>\n<h2>Solution<\/h2>\n<p>Customers are urged to apply the latest patch from Microsoft for CVE-2020-0796 for Windows 10.<\/p>\n<p>Customers can use IPS signature \u201cMS.SMB.Server.Compression.Transform.Header.Memory.Corruption\u201d to detect attacks that exploit this vulnerability.<\/p>\n<p><i>Find out about the FortiGuard Security Services\u00a0<a href=\"https:\/\/www.fortinet.com\/support\/support-services\/fortiguard-security-subscriptions.html?utm_source=blog&amp;utm_campaign=2018-blog-security-services\">portfolio<\/a>\u00a0and\u00a0<a href=\"https:\/\/www.fortinet.com\/fortiguard\/threat-intelligence\/threat-research.html?utm_source=nreleaseblog&amp;utm_campaign=2018-q2-fortiguardlabs-cta\">sign up<\/a>\u00a0for our weekly FortiGuard Threat Brief.<\/i><\/p>\n<p><i>Discover how the FortiGuard\u00a0<a href=\"https:\/\/www.fortinet.com\/support\/support-services\/fortiguard-security-subscriptions\/security-rating.html?utm_source=blog&amp;utm_campaign=2018-blog-security-rating-service\">Security Rating Service<\/a>\u00a0provides security audits and best practices to guide customers in designing, implementing, and maintaining the security posture best suited for their organization.<\/i><\/p>\n<\/p><\/div>\n<div class=\"raw-import aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"text-container\">\n<div id=\"om-qxx1b0gslklfu2kjckea-holder\"><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<p><a href=\"http:\/\/feedproxy.google.com\/~r\/fortinet\/blog\/threat-research\/~3\/QDLX9BCZjRY\/cve-2020-0796-memory-corruption-vulnerability-in-windows-10-smb-server.html\" target=\"bwo\" >http:\/\/feeds.feedburner.com\/fortinet\/blog\/threat-research<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"\/blog\/threat-research\/cve-2020-0796-memory-corruption-vulnerability-in-windows-10-smb-server\/_jcr_content\/root\/responsivegrid\/image_1295602733.img.png\/1583797263295\/picture1.png\"\/><br \/>Microsoft recently released a patch for CVE-2020-0796, a critical SMB server vulnerability that affects Windows 10. In this blog post, we attempt to explain the root cause of the CVE-2020-0796 vulnerability and protections customers can apply.&lt;img src=&#8221;http:\/\/feeds.feedburner.com\/~r\/fortinet\/blog\/threat-research\/~4\/QDLX9BCZjRY&#8221; height=&#8221;1&#8243; width=&#8221;1&#8243; alt=&#8221;&#8221;\/&gt;<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10424,10378],"tags":[],"class_list":["post-17922","post","type-post","status-publish","format-standard","hentry","category-fortinet","category-security"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/17922","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=17922"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/17922\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=17922"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=17922"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=17922"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}