{"id":18302,"date":"2022-02-16T11:40:01","date_gmt":"2022-02-16T19:40:01","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2022\/02\/16\/news-12035\/"},"modified":"2022-02-16T11:40:01","modified_gmt":"2022-02-16T19:40:01","slug":"news-12035","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/02\/16\/news-12035\/","title":{"rendered":"Analysis of Microsoft CVE-2022-21907"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

FortiGuard Labs<\/a>\u00a0Research<\/h2>\n

Affected Platforms:<\/b> Windows Server 2022, Windows Server 2019, Windows 10
Impacted Users:<\/b> Any organization with affected Windows system
Impact:<\/b> Denial of service to affected systems
Severity Level: <\/b>High <\/p>\n

On January 11th<\/sup>, 2022 Microsoft released a patch for CVE-2022-21907 as part of Microsoft\u2019s Patch Tuesday. CVE-2022-21907 attracted special attentions from industry insiders due to the claim that the vulnerability is worm-able. In this analysis we will look at the cause of the vulnerability and how attackers can exploit it.<\/p>\n

CVE-2022-21907 is a remote code execution vulnerability in Windows\u2019 Internet Information Services (IIS) component. More specifically, it affects the kernel module inside http.sys that handles most of the IIS core operations. At a minimum, the vulnerability can lead to denial of service conditions on the victim\u2019s machine by crashing the operating system. It might also be possible to combine this vulnerability with another vulnerability to enable remote code execution.<\/p>\n

We used Windows 2022 Server 10.0.20348.143 as the base of our analysis. IIS is also present on Windows 10. We also looked at the Windows 10 (2H 2021) http.sys and confirmed that the same vulnerable code path exists. However, since IIS is not enabled by default on Windows 10, the chance of Windows 10 systems being exploited is significantly less.<\/p>\n

First, we performed a binary differential between the vulnerable http.sys and the patched http.sys (10.0.20348.469). The program Bindiff compared the two binary files and highlighted the functions that have been modified. While a few functions were heavily modified, we were interested in two particular functions\u2014http!UlpAllocateFastTracker() and http!UlFastSendHttpResponse() .<\/p>\n

(As an aside, we did our initial analysis on Windows 10 http.sys, and these two functions are the only ones patched on Windows 10.)<\/p>\n

In http!UlpAllocateFastTracker(), we see the following differences:<\/p>\n<\/p><\/div>\n