HTTP

HTTP Protocol Stack Remote Code Execution Vulnerability

CVE-2021-31166

This is a proof of concept for CVE-2021-31166 (“HTTP Protocol Stack Remote Code Execution Vulnerability”), a use-after-free dereference in http.sys patched by Microsoft in May 2021. According to this tweet the vulnerability has been found by @_mxms and @fzzyhd1.

trigger

The bug itself happens in http!UlpParseContentCoding where the function has a local LIST_ENTRY and appends item to it. When it’s done, it moves it into the Request structure; but it doesn’t NULL out the local list. The issue with that is that an attacker can trigger a code-path that frees every entries of the local list leaving them dangling in the Request object.

rel04vsrel05

Here is the bugcheck:

KDTARGET: Refreshing KD connection


*** Fatal System Error: 0x00000139

                       (0x0000000000000003,0xFFFFF90EA867EE40,0xFFFFF90EA867ED98,0x0000000000000000)


Break instruction exception


 


 




 


To finish reading, please visit source site