I see you have figured out your timeout issue (usually I see people pass
in small positive values, which triggers the “timeout” point almost
immediately).
However, nobody has pointed out the glaring security hole you’ve
introduced by not validating the handle (remember: NEVER trust ANYTHING
coming from user mode…)
ObReferenceObjectByHandle should be called with the correct OBJECT_TYPE
parameter to validate that the handle is what you think it will be:
ntStatus = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE,
ExEventObjectType, KernelMode, &pevent, NULL);
That ensures the handle really IS an event object and that someone
doesn’t pass you the wrong type of handle (this really is a common
attack vector).
Just because you think it’s your application, there’s no guarantee that
it isn’t. Best to validate.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dave Wilkes
Sent: Thursday, August 11, 2005 6:03 AM
To: ntfsd redirect
Subject: [ntfsd] Waiting on events
Hello all,
I am progressing slowly with my file filter driver (but at least I am
still progressing!). Anyway I have a problem with events within my
driver,
the scenario is as follows:
Bear in mind I am writing a mini-filter based driver if this makes a
difference. I also want to set the event in the user mode app and do the
waiting in the driver (assuming this is possible).
- Create an event in a user mode app.
- Pass this event handle to the driver
- call the following code to get the pointer to the event in the
driver.
ntStatus = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE, NULL,
KernelMode, &pevent, NULL);
- call the following code to wait on the event in the driver
ntStatus = KeWaitForSingleObject(pevent, UserRequest, KernelMode, FALSE,
&lInt);
Result:
The KeWaitForSingleObject function returns immediately with
STATUS_TIMEOUT.
Is this fundamentally flawed (probably) or should this work?
Thanks in advance,
Dave
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com