Vulnerability Note VU#600671

PCAUSA Rawether for Windows local privilege escalation

Original Release date: 21 Mar 2017 | Last revised: 21 Apr 2017

Overview

PCAUSA's Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF program to perform operations on memory outside of its typical bounds on the driver's receipt of network packets. This vulnerability may be exploited to perform local privilege escalation on Windows systems.

Description

The Rawether framework for Windows, originally produced by Printing Communications Assoc., Inc. (PCAUSA), is a framework that facilitates communication between an application and the Network Driver Interface System (NDIS) protocol. This framework is used by many different hardware vendors in their WiFi and router control applications. Rawether implements the Berkeley Packet Filter (BPF) mechanism. BPF filters are compiled into small programs that are executed by a BPF virtual machine.

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer - CVE-2017-3196

The Rawether framework does not properly validate BPF programs before execution, allowing BPF programs that may read/write arbitrary memory or infinitely loop. The return address on the stack may be overwritten, allowing a local user to execute arbitrary code with SYSTEM privileges.

To enable the vulnerable part of the driver, an exploit has to issue a OID_GEN_CURRENT_PACKET_FILTER NDIS request with NDIS_PACKET_TYPE_ALL_LOCAL flags and set the BPF program. The exploit is triggered by reading the first received network packet.

The researcher has provided a proof of concept affecting the 64-bit version of PcaSp60.sys driver which is part of ASUS PCE-AC56 WLAN Card Utilities. However, other utilities and programs making use of this driver may also be affected. Identifying vulnerable software may be difficult due to variations in driver name, version, or device name or information, but the vulnerable driver is most likely included in OEM WiFi utility programs. Some common default naming convention for the affected drivers include:

  • PcaSp60.sys
  • PcaSp50.sys
  • PcaMp60.sys
  • PcaMp50.sys

    For more information, see the researcher's blog post.

    • Impact

    A local authenticated attacker may be able to execute a malicious BPF program that can execute arbitrary code with SYSTEM privileges.

    Solution

    Apply an update or uninstall affected software

    Apply an update to any software that makes use of the Rawether driver. Alternately, uninstall any affected software.

    A list of possibly affected vendors is given below and will be updated as we learn more.

    Vendor Information (Learn More)

    VendorStatusDate NotifiedDate Updated
    ASUSTeK Computer Inc.Affected17 Mar 201721 Mar 2017
    Printing Communications Association, Inc.Affected-17 Mar 2017
    DellNot Affected17 Mar 201721 Apr 2017
    AcerUnknown17 Mar 201717 Mar 2017
    Hewlett Packard EnterpriseUnknown17 Mar 201717 Mar 2017
    LenovoUnknown17 Mar 201717 Mar 2017
    Toshiba America Information Systems, Inc.Unknown17 Mar 201717 Mar 2017
    VAIO CorporationUnknown17 Mar 201717 Mar 2017
    If you are a vendor and your product is affected, let us know.

    CVSS Metrics (Learn More)

    Group Score Vector
    Base 6.6 AV:L/AC:M/Au:S/C:C/I:C/A:C
    Temporal 5.6 E:POC/RL:U/RC:UR
    Environmental 4.2 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

    References

    Credit

    This issue was reported publicly by "ReWolf" (@rwfpl).

    This document was written by Garret Wassermann.

    Other Information

    • CVE IDs: CVE-2017-3196
    • Date Public: 15 Mar 2017
    • Date First Published: 21 Mar 2017
    • Date Last Updated: 21 Apr 2017
    • Document Revision: 34

    Feedback

    If you have feedback, comments, or additional information about this vulnerability, please send us email.