CVE-2017-12561 - HPE iMC dbman Use-After-Free

Technical analysis of CVE-2017-12561, a use-after-free vulnerability in the dbman service of Hewlett Packard Enterprise Intelligent Management Center (iMC).

Overview

The vulnerability affects the service's handling of opcode 10012. Incorrect object lifetime management allows a previously freed object to be accessed again, resulting in memory corruption.

According to ZDI-17-836, the flaw is reachable without authentication and can allow remote code execution with SYSTEM privileges. The dbman service listens on TCP port 2810 by default.

About this research

This repository contains my reverse-engineering write-up and accompanying proof of concept. The analysis covers:

• Binary comparison using IDA and Diaphora to examine changes between vulnerable and patched binaries.
• Analysis of the service's command handling and ASN.1/BER decoding.
• Debugging of the crash and investigation of object cleanup and subsequent reuse in the ACE event-handling lifecycle.

The documented testing was performed on Windows Server 2008 R2 Datacenter x64. The write-up demonstrates a crash and investigates its use-after-free root cause; it does not demonstrate a complete remote code execution exploit.

Write-up

Read the full technical analysis.

Credits and references

• Reverse engineering and write-up: Filipe Oliveira (Everdoh).
• Original vulnerability discovery: Steven Seeley (mr_me) of Offensive Security, as credited by ZDI.
• Advisory: ZDI-17-836, published October 3, 2017.