Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Validate the service pipe to avoid connecting to a bogus pipe #691

Merged
merged 1 commit into from
Jun 19, 2024
Merged

Validate the service pipe to avoid connecting to a bogus pipe #691

merged 1 commit into from
Jun 19, 2024

Commits on Jun 19, 2024

  1. Validate the service pipe to avoid connecting to a bogus pipe 

    If an attacker with SeImeprsonatePrivilege manages to create a
namedpipe server with a name matching that used by the "Interactive
Service", the GUI connecting to it could allow the attacker to
impersonate the GUI user.

Fix by validating the service pipe by comparing the pid of the pipe
server with that of the "Interactive Service".

Note: GetNamedPipeServerProcessId() returns the pid of the process
that created the first instance of the pipe. So, this patch only
guards against a rogue pipe instance created before the service
has started. This has to work in combination with a patch for the
service that disallows creation of additional pipe instances when
the service is running.

CVE: CVE-2024-4877
Reported by: Zeze with TeamT5 <[email protected]>

Acked-by: Lev Stipakov <[email protected]>
Signed-off-by: Selva Nair <[email protected]>
    @selvanair
    selvanair committed Jun 19, 2024
    Configuration menu
    Copy the full SHA
    5cce04f View commit details
    Browse the repository at this point in the history