Headline

CVE-2022-41992: TALOS-2022-1644 || Cisco Talos Intelligence Group

A memory corruption vulnerability exists in the VHD File Format parsing CXSPARSE record functionality of PowerISO PowerISO 8.3. A specially-crafted file can lead to an out-of-bounds write. A victim needs to open a malicious file to trigger this vulnerability.

1 year ago

CVE

Open in Source

#vulnerability #mac #windows #microsoft #cisco #intel #perl

SUMMARY

CONFIRMED VULNERABLE VERSIONS

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

PowerISO PowerISO 8.3

PRODUCT URLS

PowerISO - https://www.poweriso.com/

CVSSv3 SCORE

7.8 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

DETAILS

PowerISO is a disk image file processing tool supporting operations on various file formats, and also allows to mount images as a virtual drive.

Virtual Hard Disk (VHD) Image format is a commonly image format used in Microsoft virtualization products. It is both used to store hard disk images and snapshots.
For more details about this format see link.

Vulnerable code below:

    0000000000442869 | 41:8B0C38                | mov ecx,dword ptr ds:[r8+rdi]
    000000000044286D | 41:FFC1                  | inc r9d
    0000000000442870 | 8BC1                     | mov eax,ecx
    0000000000442872 | 8BD1                     | mov edx,ecx
    0000000000442874 | C1E9 08                  | shr ecx,8
    0000000000442877 | C1E2 10                  | shl edx,10
    000000000044287A | 41:23C5                  | and eax,r13d
    000000000044287D | 41:23CD                  | and ecx,r13d
    0000000000442880 | 0BD0                     | or edx,eax
    0000000000442882 | 41:0FB64438 03           | movzx eax,byte ptr ds:[r8+rdi+3]
    0000000000442888 | C1E2 08                  | shl edx,8
    000000000044288B | 0BD0                     | or edx,eax
    000000000044288D | 48:8B43 10               | mov rax,qword ptr ds:[rbx+10]
    0000000000442891 | 0BD1                     | or edx,ecx
    0000000000442893 | 41:891400                | mov dword ptr ds:[r8+rax],edx
    0000000000442897 | 49:83C0 04               | add r8,4
    000000000044289B | 44:3B4B 18               | cmp r9d,dword ptr ds:[rbx+18]       ; * Num of blocks from cxsparse record
    000000000044289F | 72 C8                    | jb poweriso.442869

Vulnerability exists because the “Num of blocks” value from the CXSPARSE record is not validated properly.
An attacker can control the loop counter leading to arbitrary memory write.

Crash Information

    PowerISO+0x42893:
    00000000`00442893 41891400        mov     dword ptr [r8+rax],edx ds:00000000`02b2f000=????????


    0:000> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************


    KEY_VALUES_STRING: 1

        Key  : AV.Fault
        Value: Write

        Key  : Analysis.CPU.mSec
        Value: 1281

        Key  : Analysis.DebugAnalysisManager
        Value: Create

        Key  : Analysis.Elapsed.mSec
        Value: 17362

        Key  : Analysis.IO.Other.Mb
        Value: 9

        Key  : Analysis.IO.Read.Mb
        Value: 1

        Key  : Analysis.IO.Write.Mb
        Value: 12

        Key  : Analysis.Init.CPU.mSec
        Value: 406

        Key  : Analysis.Init.Elapsed.mSec
        Value: 9616

        Key  : Analysis.Memory.CommitPeak.Mb
        Value: 106

        Key  : Timeline.OS.Boot.DeltaSec
        Value: 471002

        Key  : Timeline.Process.Start.DeltaSec
        Value: 12

        Key  : WER.OS.Branch
        Value: vb_release

        Key  : WER.OS.Timestamp
        Value: 2019-12-06T14:06:00Z

        Key  : WER.OS.Version
        Value: 10.0.19041.1

        Key  : WER.Process.Version
        Value: 8.3.0.0


    NTGLOBALFLAG:  0

    PROCESS_BAM_CURRENT_THROTTLED: 0

    PROCESS_BAM_PREVIOUS_THROTTLED: 0

    APPLICATION_VERIFIER_FLAGS:  0

    EXCEPTION_RECORD:  (.exr -1)
    ExceptionAddress: 0000000000442893 (PowerISO+0x0000000000042893)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000001
       Parameter[1]: 0000000002c5f000
    Attempt to write to address 0000000002c5f000

    FAULTING_THREAD:  00000ba0

    PROCESS_NAME:  PowerISO.exe

    WRITE_ADDRESS:  0000000002c5f000 

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

    EXCEPTION_CODE_STR:  c0000005

    EXCEPTION_PARAMETER1:  0000000000000001

    EXCEPTION_PARAMETER2:  0000000002c5f000

    STACK_TEXT:  
    00000000`0014de30 00000000`00442aad     : 00000000`00000200 00000000`00000000 00000000`000007b3 00000000`3000cbfb : PowerISO+0x42893
    00000000`0014e2b0 00000000`00442d2c     : 00000000`05a603c0 00000000`00000000 78697463`656e6f63 00000000`00000001 : PowerISO+0x42aad
    00000000`0014e520 00000000`004061ae     : 00000000`00000001 00000000`00000688 00000000`03380f70 00000000`03380f70 : PowerISO+0x42d2c
    00000000`0014e560 00000000`005d6cf6     : 00000000`0014e7a8 00000000`0014e7a8 00000000`00000001 00000000`02ba853c : PowerISO+0x61ae
    00000000`0014e710 00000000`004f2733     : 00000000`0014e8b0 00000000`00000000 00000000`00000000 00007ff9`4a6dc9bb : PowerISO+0x1d6cf6
    00000000`0014e830 00000000`004f2fc5     : 00000000`1c12beb3 00000000`0014ebc8 00000000`66076fb2 00000000`d88dfeb5 : PowerISO+0xf2733
    00000000`0014eb90 00000000`005561ef     : 00000000`00000004 00000000`0333ba1c 00000000`00000000 00000000`03348f60 : PowerISO+0xf2fc5
    00000000`0014ebc0 00000000`004ee5ad     : 00000000`0014ed00 00007ff9`35ff414e 00000000`00000004 00008731`00000002 : PowerISO+0x1561ef
    00000000`0014ebf0 00000000`006280ed     : 00000000`00000001 00007ff9`4a6deb96 00000000`00000363 00000000`00000001 : PowerISO+0xee5ad
    00000000`0014f890 00000000`00624c83     : 00000000`02b50150 ffffffff`ffffffff 00000000`00000006 00000000`00000080 : PowerISO+0x2280ed
    00000000`0014f9c0 00000000`004ebf6f     : 00000000`00000000 00000000`00d3103e 00000000`03348f60 00000000`00000001 : PowerISO+0x224c83
    00000000`0014fa20 00000000`00626410     : ffffffff`fffffffe 00000000`00000113 00000000`00000000 00000000`00000113 : PowerISO+0xebf6f
    00000000`0014fa50 00000000`006265be     : 00000000`008df500 00000000`00becb30 00000000`0333c920 00007ff9`02000002 : PowerISO+0x226410
    00000000`0014fb10 00007ff9`4a6de858     : 00000000`008df4a0 00000000`00000113 00000000`00000001 00000000`00000000 : PowerISO+0x2265be
    00000000`0014fb70 00007ff9`4a6de299     : 00000000`00d3103e 00000000`00626570 00000000`00d3103e 00000000`00000113 : USER32!UserCallWinProcCheckWow+0x2f8
    00000000`0014fd00 00000000`00621c6d     : 00000000`00626570 00000000`008df4a0 00000000`00000002 00000000`008df4a0 : USER32!DispatchMessageWorker+0x249
    00000000`0014fd80 00000000`00621aa9     : 00000000`008df4a0 00000000`00400000 00000000`00000001 00000000`00000000 : PowerISO+0x221c6d
    00000000`0014fdc0 00000000`0062aa57     : 00000000`006486d8 00000000`00000000 00000000`00648718 00000000`00648720 : PowerISO+0x221aa9
    00000000`0014fe20 00000000`005f607b     : 00000000`00000045 00000000`00000000 00000000`00000000 00000000`00400000 : PowerISO+0x22aa57
    00000000`0014fe80 00007ff9`4a627034     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : PowerISO+0x1f607b
    00000000`0014ff30 00007ff9`4a9426a1     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
    00000000`0014ff60 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21


    STACK_COMMAND:  ~0s ; .cxr ; kb

    SYMBOL_NAME:  PowerISO+42893

    MODULE_NAME: PowerISO

    IMAGE_NAME:  PowerISO.exe

    FAILURE_BUCKET_ID:  INVALID_POINTER_WRITE_c0000005_PowerISO.exe!Unknown

    OS_VERSION:  10.0.19041.1

    BUILDLAB_STR:  vb_release

    OSPLATFORM_TYPE:  x64

    OSNAME:  Windows 10

    IMAGE_VERSION:  8.3.0.0

    FAILURE_ID_HASH:  {1b12d601-7fad-79d8-d5a8-9f7caedc20c8}

    Followup:     MachineOwner
    ---------

TIMELINE

2022-10-27 - Vendor Disclosure
2022-11-28 - Vendor Patch Release
2022-12-07 - Public Release

Discovered by Piotr Bania of Cisco Talos.

Piotr Bania of Cisco Talos discovered this vulnerability. Cisco Talos recently discovered a memory corruption vulnerability in PowerISO. TALOS-2022-1644 (CVE-2022-41992) is a memory corruption vulnerability that exists in the VHD File Format parsing functionality of PowerISO 8.3. A specially crafted file can lead to an out-of-bounds write. A victim

1 year ago

TALOS

Open in Source

#vulnerability #cisco #perl