diff options
| author | Mounir IDRASSI <mounir.idrassi@idrix.fr> | 2015-09-21 17:09:26 +0200 |
|---|---|---|
| committer | Mounir IDRASSI <mounir.idrassi@idrix.fr> | 2015-09-26 17:44:00 +0200 |
| commit | b7f9df6e4f09ba342fdbbadc63af5062cc57eaf2 (patch) | |
| tree | 442efda966796d1dc32ad01ee74bd255ae041094 /src/Driver/Ntdriver.c | |
| parent | fda4d3f8200145cfbe57d3809a7e0898a4669320 (diff) | |
| download | VeraCrypt-b7f9df6e4f09ba342fdbbadc63af5062cc57eaf2.tar.gz VeraCrypt-b7f9df6e4f09ba342fdbbadc63af5062cc57eaf2.zip | |
Windows Driver: Fix inherited TrueCrypt local elevation of privilege vulnerability caused by incorrect impersonation token handling. Reported and fixed by James Forshaw (Google)
Diffstat (limited to 'src/Driver/Ntdriver.c')
| -rw-r--r-- | src/Driver/Ntdriver.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/src/Driver/Ntdriver.c b/src/Driver/Ntdriver.c index 845aec6f..8c33a89c 100644 --- a/src/Driver/Ntdriver.c +++ b/src/Driver/Ntdriver.c @@ -2664,7 +2664,10 @@ NTSTATUS MountDevice (PDEVICE_OBJECT DeviceObject, MOUNT_STRUCT *mount) SeCaptureSubjectContext (&subContext);
SeLockSubjectContext(&subContext);
- accessToken = SeQuerySubjectContextToken (&subContext);
+ if (subContext.ClientToken && subContext.ImpersonationLevel >= SecurityImpersonation)
+ accessToken = subContext.ClientToken;
+ else
+ accessToken = subContext.PrimaryToken;
if (!accessToken)
{
@@ -3403,7 +3406,11 @@ BOOL IsVolumeAccessibleByCurrentUser (PEXTENSION volumeDeviceExtension) }
SeCaptureSubjectContext (&subContext);
- accessToken = SeQuerySubjectContextToken (&subContext);
+ SeLockSubjectContext(&subContext);
+ if (subContext.ClientToken && subContext.ImpersonationLevel >= SecurityImpersonation)
+ accessToken = subContext.ClientToken;
+ else
+ accessToken = subContext.PrimaryToken;
if (!accessToken)
goto ret;
@@ -3421,6 +3428,7 @@ BOOL IsVolumeAccessibleByCurrentUser (PEXTENSION volumeDeviceExtension) ExFreePool (tokenUser); // Documented in newer versions of WDK
ret:
+ SeUnlockSubjectContext(&subContext);
SeReleaseSubjectContext (&subContext);
return result;
}
|