malwareman007/cve-2022-26937POC de CVE-2022-26937
nt!KeBugCheckEx:
fffff803`8996efa0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffd000`d589ae60=0000000000000139
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000002, Stack cookie instrumentation code detected a stack-based
buffer overrun.
Arg2: ffffd000d589b180, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffffd000d589b0d8, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 1124
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 34762
Key : Analysis.Init.CPU.mSec
Value: 609
Key : Analysis.Init.Elapsed.mSec
Value: 517613
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : FailFast.Name
Value: STACK_COOKIE_CHECK_FAILURE
Key : FailFast.Type
Value: 2
Key : WER.OS.Branch
Value: winblue_gdr
Key : WER.OS.Timestamp
Value: 2014-02-21T19:52:00Z
Key : WER.OS.Version
Value: 8.1.9600.17031
FILE_IN_CAB: 061622-6921-01.dmp
VIRTUAL_MACHINE: VMware
BUGCHECK_CODE: 139
BUGCHECK_P1: 2
BUGCHECK_P2: ffffd000d589b180
BUGCHECK_P3: ffffd000d589b0d8
BUGCHECK_P4: 0
TRAP_FRAME: ffffd000d589b180 -- (.trap 0xffffd000d589b180)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000c0000001 rbx=0000000000000000 rcx=0000000000000002
rdx=ffffe000515c2010 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80158eeeb05 rsp=ffffd000d589b318 rbp=ffffd000d589b420
r8=ffffe000515c2010 r9=0000000000000268 r10=ffffe000514df130
r11=ffffe0005188d010 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po nc
nfssvr!_report_gsfailure+0x5:
fffff801`58eeeb05 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffd000d589b0d8 -- (.exr 0xffffd000d589b0d8)
ExceptionAddress: fffff80158eeeb05 (nfssvr!_report_gsfailure+0x0000000000000005)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000002
Subcode: 0x2 FAST_FAIL_STACK_COOKIE_CHECK_FAILURE
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000002
EXCEPTION_STR: 0xc0000409
SYMBOL_NAME: nfssvr!_report_gsfailure+5
MODULE_NAME: nfssvr
IMAGE_NAME: nfssvr.sys
IMAGE_VERSION: 6.3.9600.16384
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 5
FAILURE_BUCKET_ID: 0x139_MISSING_GSFRAME_nfssvr!_report_gsfailure
OS_VERSION: 8.1.9600.17031
BUILDLAB_STR: winblue_gdr
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
FAILURE_ID_HASH: {998b6b82-b64e-49ce-d962-6836c54aa899}
Followup: MachineOwner
---------