An overview of the LFH Mitigation Observations Conclusion Bruno - - PowerPoint PPT Presentation

▶
an overview of the lfh
SMART_READER_LITE
LIVE PREVIEW

An overview of the LFH Mitigation Observations Conclusion Bruno - - PowerPoint PPT Presentation

Dec 29, 2022 166 likes •845 views

An overview of the LFH Bruno Pujos Introduction How it works Windows An overview of the LFH Mitigation Observations Conclusion Bruno Pujos July 20, 2014 Plan An overview of the LFH Bruno Pujos Introduction How it works Windows

slide-1
SLIDE 1

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

An overview of the LFH

Bruno Pujos July 20, 2014

slide-2
SLIDE 2

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Plan

1

Introduction

slide-3
SLIDE 3

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

The LFH?

  • Low Fragmentation Heap: Front End allocator
  • Userland (sorry, no kernel this time. . . )
  • Windows 8/8.1 32bit
  • Why talk about it?
  • Some details were left out to keep it simple
slide-4
SLIDE 4

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

General Memory Management

slide-5
SLIDE 5

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

A little bit of history

  • LFH released with Windows XP (2001) but not

enabled by default

  • The Look-Aside-List was another Front End allocator

at that time

  • Since Vista, no more LAL, and LFH is enabled by

default

slide-6
SLIDE 6

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Plan

1

Introduction

2

How it works Structures Allocation Free

3

Windows Mitigation

4

Observations

5

Conclusion

slide-7
SLIDE 7

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

Plan

2

How it works Structures Allocation Free

slide-8
SLIDE 8

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

Plan

2

How it works Structures Allocation Free

slide-9
SLIDE 9

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

General Overview

slide-10
SLIDE 10

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

General Overview

slide-11
SLIDE 11

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

_HEAP & _LFH_HEAP

slide-12
SLIDE 12

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

General Overview

slide-13
SLIDE 13

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

_HEAP_BUCKET

slide-14
SLIDE 14

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

General Overview

slide-15
SLIDE 15

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

_HEAP_LOCAL_SEGMENT_INFO

slide-16
SLIDE 16

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

General Overview

slide-17
SLIDE 17

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

Subsegment & UserBlocks

slide-18
SLIDE 18

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

Plan

2

How it works Structures Allocation Free

slide-19
SLIDE 19

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

Allocation Workflow

slide-20
SLIDE 20

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH activation & Back-end

  • RtlpAllocateHeap(_HEAP *Heap, int Flags, int Size,

unsigned int RoundedSize, _LIST_ENTRY *ListHint, int *RetCode)

  • HEAP_NO_SERIALIZE
  • Heap->CompatibilityFlags & 0x20000000: activation
  • f the LFH needed
  • RtlpPerformHeapMaintenance(_HEAP *Heap)
slide-21
SLIDE 21

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH activation & Back-end

Allocation of size < 0x4000

  • if the LFH is not activated: set the CompatibilityFlags
  • if the LFH is not activated for this size:
  • add 0x21 in the Heap->FrontEndHeapUsageData[]
  • if 0x10 consecutive allocations or

Heap->FrontEndHeapUsageData[] > 0xff00: activate for the next allocation of the same size

Activation for a given size

  • set Heap->FrontEndHeapUsageData[] to the

BucketIndex

  • set Heap->FrontEndHeapStatusBitmap[] to 1

(activated)

slide-22
SLIDE 22

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

Allocation Workflow

slide-23
SLIDE 23

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Allocation

  • size <= 0x4000
  • HEAP_NO_SERIALIZE
  • Heap->FrontEndHeapStatusBitmap == 1
  • RtlpLowFragHeapAllocFromContext(_LFH_HEAP

*LFH, unsigned short BucketIndex, int Size, char Flags)

slide-24
SLIDE 24

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Allocation Workflow

slide-25
SLIDE 25

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Initialisation

slide-26
SLIDE 26

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Initialisation

slide-27
SLIDE 27

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Initialisation

slide-28
SLIDE 28

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Initialisation

slide-29
SLIDE 29

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Randomization

slide-30
SLIDE 30

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Randomization

slide-31
SLIDE 31

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Randomization

  • RtlpLowFragHeapRandomData
  • LowFragHeapDataSlot (in the TEB)
slide-32
SLIDE 32

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Allocation

slide-33
SLIDE 33

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Allocation

slide-34
SLIDE 34

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Cache

slide-35
SLIDE 35

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Cache

  • Check the cache
  • Try to allocate UserBlocks and/or Subsegment
  • Fail if RtlAllocateHeap fails
  • Update RtlpLowFragHeapRandomData in

Subsegment allocation

slide-36
SLIDE 36

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Cache

slide-37
SLIDE 37

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Allocation Workflow

slide-38
SLIDE 38

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

Plan

2

How it works Structures Allocation Free

slide-39
SLIDE 39

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

Free Workflow

slide-40
SLIDE 40

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

Free Back-end

  • RtlpFreeHeap(_HEAP *Heap, int Flags,

_HEAP_ENTRY *Header, void *Chunk)

  • Decrement the counter in

Heap->FrontEndHeapUsageData[]

slide-41
SLIDE 41

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

Free Workflow

slide-42
SLIDE 42

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Free

  • No longer handled by RtlpLowFragHeapFree
  • Same algorithm idea in Windows 8 and 8.1
  • Header->UnusedBytes & 0x80
  • Always returns true
slide-43
SLIDE 43

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Free Workflow

slide-44
SLIDE 44

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Free Initialisation

slide-45
SLIDE 45

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Free Initialisation

slide-46
SLIDE 46

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Free Mark

slide-47
SLIDE 47

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Free Mark

slide-48
SLIDE 48

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Free Fail

slide-49
SLIDE 49

An overview of the LFH Bruno Pujos Introduction How it works

Structures Allocation Free

Windows Mitigation Observations Conclusion

LFH Free Check UserBlocks

slide-50
SLIDE 50

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Plan

3

Windows Mitigation

slide-51
SLIDE 51

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Attackers goal

  • The goal is always to control eip
  • For a ”generic” heap exploitation:
  • Arbitrary write
  • Trigger a free
  • . . .
slide-52
SLIDE 52

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Safe Linking/Unlinking

  • Moore 2005, but also in Linux malloc. . .
  • The idea is to corrupt a double-linked list (stored in

metadata)

  • Could allow arbitrary 4-write
  • Check introduced in Windows XP SP2, and

generalized since then

slide-53
SLIDE 53

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Arbitrary Free

  • Ben Hawkes 2008
  • Before Windows 8:

i f ( Header−>UnusedBytes == 0x5 ) Header −= 8 ∗ Header−>SegmentOffset ;

  • Overwrite of a _HEAP_ENTRY would allow a

semi-arbitrary free

  • Windows 8 introduces a check
slide-54
SLIDE 54

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Ben Hawkes

  • LFH overflow: structures have changed
  • FrontEndHeapUsageData
  • _RTL_BITMAP
  • Off-by-one: encoded and changes the structure
  • Heap Overflows: no more free of the heap
slide-55
SLIDE 55

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

FreeEntryOffset Overwrite

  • Chris Valasek 2010
  • Before Windows 8, a free chunk would contain a

NextOffset field of a free chunk in the first 2 bytes after the _HEAP_ENTRY

  • Overwrite it so that a chunk will be allocated and

allow a semi-controlled allocation (the next one)

  • Rewrite data of another chunk :)
  • NextOffset doesn’t exist in Windows 8, use

_HEAP_USERDATA_HEADER to locate free chunks

slide-56
SLIDE 56

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

LFH GuardPages

  • Since Windows 8
  • Created during a UserBlocks allocation
  • Protection against sequential overflow
  • Protection to prevent UserBlocks overwrite
  • PAGE_NOACCESS
  • Possible to avoid triggering them by doing few

allocations

slide-57
SLIDE 57

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Fast fail

  • HeapEnableTerminationOnCorruption
  • Fast fail is an interrupt (int 0x29) which halts the

execution of the process

slide-58
SLIDE 58

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Non-deterministic virtual allocation

  • For a request of a certain size

(> VirtualMemoryThreshold), use NtAllocateVirtualMemory

  • Before Windows 8: predictable memory layouts.
  • Since Windows 8: the virtual allocation start at a

random offset within the whole virtual chunk.

slide-59
SLIDE 59

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Non-deterministic allocation

  • Already covered
slide-60
SLIDE 60

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

_HEAP_USERDATA_HEADER Overwrite

  • In Windows 8, the BlockStride and the

FirstAllocationOffset are not encoded

  • Header when allocating:

Header = (_HEAP_ENTRY) UserBlocks + UserBlocks−> F i r s t A l l o c a t i o n O f f s e t + ( NewHint ∗ UserBlocks−>BlockStride ) ;

  • If we overwrite FirstAllocationOffset and/or

BlockStride, a semi-arbitrary address is returned by the LFH

  • Since Windows 8.1, FirstAllocationOffset and

BlockStride are encoded: EncodedOffsets ˆ UserBlocks ˆ LFH ˆ RtlpLFHKey

slide-61
SLIDE 61

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Plan

4

Observations

slide-62
SLIDE 62

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Determinism

  • Non-deterministic allocations break a lot of things
  • How to be determinist again?
  • RtlpLowFragHeapRandomData are random but fix
  • LowFragHeapDataSlot is a counter with a modulo

0x100

  • Just allocate and free a 0x100 chunk to have the

same value again from RtlpLowFragHeapRandomData

  • Need to avoid subsegment allocation
  • Need to be able to allocate and free the specific size

we want

slide-63
SLIDE 63

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Determinism

  • Not only useful for use-after-free, but also for
  • verflow
  • Allocate the vulnerable chunk
  • Allocate and Free for 0x100 times
  • Allocate the chunk to overflow
  • Trigger the overflow
  • Work only if we are sure that the chunk next to the

vulnerable one is free (and we are lucky enough not to allocate the last chunk. . . )

slide-64
SLIDE 64

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Bitmap Flipping 2.0

  • Valasek & Mandt 2012
  • When a free is made, the offset of the byte to clear in

the bitmap is determined by Header->Previous

  • If we can overwrite the Heap->Previous it could to go
  • ut of the bitmap and set one bit to 0
  • Problem: we need to overwrite the subsegment

encoded with a good value

  • Should still work if it can be triggered
slide-65
SLIDE 65

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Plan

5

Conclusion

slide-66
SLIDE 66

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Conclusion

”Application specific attacks are the future” Ben Hawkes 2008

slide-67
SLIDE 67

An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

Link

  • http://illmatics.com/Windows%208

%20Heap%20Internals.pdf

  • http://illmatics.com/Understanding_the_LFH.pdf
  • https://media.blackhat.com/eu-13/briefings/Liu/bh-

eu-13-liu-advanced-heap-WP .pdf

  • https://www.lateralsecurity.com/downloads/hawkes_

ruxcon-nov-2008.pdf

  • http://sebug.net/paper/Meeting-

Documents/hitbsecconf2012ams/D2T2%20- %20Steven%20Seeley%20- %20Ghost%20In%20the%20Windows%20 7%20Allocator.pdf

  • http://www.blackhat.com/presentations/bh-usa-

09/MCDONALD/BHUSA09-McDonald- WindowsHeap-PAPER.pdf

  • ntdll.dll 6.3.9600.17031 (Windows 8.1)
  • ntdll.dll 6.2.9200.16384 (Windows 8)