Information

The vulnerability can be reproduced on all available Windows versions (clients and servers). However, the analysis was done on Windows 10 32bit with version 5.0.1.1 of “C:\Windows\System32\mqqm.dll”.

First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0000c0c0 ebx=0000005c ecx=0000000a edx=0000c0c0 esi=18e33000 edi=18e32c48
eip=6a467bcb esp=061cf7c0 ebp=061cf7e0 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010216
MQQM!FindPathNameDelimiter+0x2d:
6a467bcb 0fb706          movzx   eax,word ptr [esi]       ds:0023:18e33000=????
0:008> k
 # ChildEBP RetAddr      
00 061cf7e0 6a467fa0     MQQM!FindPathNameDelimiter+0x2d
01 061cf800 6a4686eb     MQQM!ParseMachineNameString+0x16
02 061cf834 6a469a87     MQQM!ParseDirectString+0x90
03 061cf870 6a4454e2     MQQM!FnIsValidQueueFormat+0x6e
04 061cf8ac 6a421cfc     MQQM!CUserHeader::SectionIsValid+0x274
05 061cf91c 6a422160     MQQM!CSockTransport::ReadUsrHeaderCompleted+0x3c
06 061cf954 6a42209c     MQQM!CSockTransport::ReadCompleted+0xbd
07 061cf968 6a45a4c0     MQQM!CSockTransport::ReceiveDataSucceeded+0x5c
08 061cf9a8 768dcfc9     MQQM!ExpWorkingThread+0xc0
09 061cf9b8 778926b5     KERNEL32!BaseThreadInitThunk+0x19
0a 061cfa14 77892689     ntdll!__RtlUserThreadStart+0x2b
0b 061cfa24 00000000     ntdll!_RtlUserThreadStart+0x1b
0:008> db esi-40
18e32fc0  c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0  ................
18e32fd0  c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0  ................
18e32fe0  c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0  ................
18e32ff0  c0 c0 c0 c0 c0 c0 c0 c0-c0 c0 c0 c0 c0 c0 c0 c0  ................
18e33000  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
18e33010  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
18e33020  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
18e33030  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????

The bug occurs because the affected code reads unicode bytes one by one for the “OS:xxxx….” string, searching for the 0x005C (“\”) until reaching a NULL unicode byte 0x0000. If there’s no 0x005C, it reads data out of the packet scope, which may crash the target process.



References:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21769