Hi, We've published a paper about using 1 or 4 byte write-what-where condition to convert a custom Data-Segment Descriptor entry in LDT of a process into a Call-Gate (with DPL set to 3 and RPL to 0). The paper also contains information about a possible LDT redirecting into user-land memory.
The paper is Windows NT family (starting from Windows 2000 and XP) and x86 protected mode specific. The paper DOES NOT contain information about new or old vulnerabilities. It only proposes a way to convert a potential write-what-where vulnerability into code execution, in a stable manner. http://vexillium.org/dl.php?call_gate_exploitation.pdf More information is available on our blogs: http://gynvael.coldwind.pl/?id=274 http://j00ru.vexillium.org/?p=290&lang=en Comments are welcomed :) Take care, -- gynvael.coldwind//vx and j00ru//vx _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
