SSD Advisory – Bitdefender Code Signing organizationName Buffer Overflow

Vulnerability Summary
The following advisory describes a Buffer Overflow vulnerability found in Bitdefender Engine PE.

Bitdefender provides the Bitdefender “antimalware” engine for integration with other security vendors products. The engine is used in Bitdefender’s own products, for example in Bitdefender Internet Security 2017 and below. The antimalware engine is the core of the product, among other features providing the means to scan potentially malicious portable executables (PEs).

Credit
An independent security researcher, Pagefault, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor Response
Bitdefender has released patched to address this vulnerability in version 7.71417.

Vulnerability Details
A PE file can be signed using X.509 certificates. The certificates can ensure that the content of the executable has not been altered and that the executable comes from a trusted source.

Certificates are embedded inside one of the PE data directories defined via IMAGE_NT_HEADERS.IMAGE_OPTIONAL_HEADER.

The IMAGE_NT_HEADERS structure inside a PE file starts with the “PE” signature:

The IMAGE_OPTIONAL_HEADER structure contains several DataDirectory IMAGE_DATA_DIRECTORY structures inside its last fields:

DataDirectory[4] represents IMAGE_DIRECTORY_ENTRY_SECURITY, and points to a list of WIN_CERTIFICATE structures. The VirtualAddress field is a file offset, rather than an RVA.

The WIN_CERTIFICATE structures is defined as follows:

vsserv.exe is the Bitdefender system service. The process scans PEs automatically, analyzing digital signatures through the cevakrnl.rv8 module. The module is located in a compressed form under “%ProgramFiles%Common FilesBitdefenderBitdefender Threat ScannerAntivirus_…Plugins“.

cevakrnl.rv8 is unpacked and loaded as executable code on service startup. cevakrnl.rv8!sub_40ACFF0() is called when a signed PE is encountered.

A maximum number of 0x2400 bytes is then read from the defined offset into a heap buffer.

After additional irrelevant operations, Bitdefender starts searching for X.509 “organizationName” attributes in encountered data. The attributes are located by searching for the 0x0A045503 dword, which is the ASN.1 representation of the organizationName OID 2.5.4.10.

When an “organizationName” is found, its corresponding value string is passed in a call to a CRC32-computing function. The function returns the inverted (bitwise NOT) CRC32 sum of the string.

Please note that only printable ASCII (0x20-0x7E) characters are considered valid in “organizationName“.

If the CRC was not previously encountered:

its value is placed inside a local stack array of 8 dwords. The index of the array is increased for each unique CRC without checking the array limit. This results in a stack-based buffer overflow if an overly large number of unique “organizationName” values are encountered.

The vulnerability allows overwriting a large number of stack bytes with arbitrary data. The data written to the stack is arbitrary due to the ability to find an ASCII string for any desired CRC result by reversing the CRC32 algorithm.

Although the vulnerable function contains a cookie check on return, code execution is believed possible due to the use of an object placed on the stack prior to function return.

The object is passed to the vulnerable function as the first argument, and the field at offset 0x1C (changed to 0xdeadbeef via the PoC) is passed to global_function0().

global_function0() calls sub_2F70B90(), passing [0xdeadbeef+0x22C] as the current object.

sub_2F70B90() extracts a dword from the current object pointer

eventually passing it as the current object to sub_2F6F120()

sub_2F6F120() eventually extracts a dword from the potentially arbitrary pointer, resulting in a jump to an arbitrary address.

The ability to jump to an arbitrary address depends on the ability to place controlled content at a fixed address. Heap spraying could be used for this purpose. This is believed achievable due to the complexity of the Bitdefender engine.