‘Lenovo Rescue and Recovery Local Kernel Overflow’
Summary
‘Lenovo Rescue and Recovery monitors system changes and enables users to quickly restore their systems in the event of failure. One component of the Rescue and Recovery system is a file system filter driver which monitors new file writes/reads.
Credit:
‘The information has been provided by Chris Clark and Rachel Engel.
The original article can be found at: https://www.isecpartners.com/advisories/2008-02-lenovornr.txt‘
Details
‘Vulnerable Systems:
* Lenovo Rescue and Recovery verison 4.20
The tvtumon.sys driver serves as a file system filter driver which monitors for file creation or changes. Recent lookups are cached within a kernel lookaside list. If an overly long filename is passed through the filesystem, then a buffer within the lookaside list will overflow, leading to kernel memory corruption.
A low privileged user can trigger this corruption from user mode and potentially escalate privileges to act as part of the kernel. In the (unlikely) event that a web browser plugin allows opening of long filenames, there is a chance the corruption could be triggered through a web page.
Fix Information:
Lenovo has issued a patch and advisory:
http://www-307.ibm.com/pc/support/site.wss/MIGR-70699.html
http://www-307.ibm.com/pc/support/site.wss/MIGR-4Q2QAK.html‘