[reactos] 01/01: [NTOS:SE] Assign the captured privilege or SID as NULL when releasing

[George Bișoc]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=8479509a7bc482ea2aaaf7...

commit 8479509a7bc482ea2aaaf73a8c12d42521ced794
Author:     George Bișoc [e-mail]
AuthorDate: Wed Feb 9 10:29:56 2022 +0100
Commit:     George Bișoc [e-mail]
CommitDate: Wed Feb 9 10:29:56 2022 +0100

[NTOS:SE] Assign the captured privilege or SID as NULL when releasing

Whenever a captured security property such as privilege or SID is released, we must not have such captured property point at random address in memory but rather we must assign it as NULL after it's been freed from pool memory. This avoids potential double-after-free situations where we might release a buffer twice.
    This is exactly the case with token filtering.
---
 ntoskrnl/se/priv.c  | 1 +
 ntoskrnl/se/sid.c   | 1 +
 ntoskrnl/se/token.c | 8 +-------
 3 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/ntoskrnl/se/priv.c b/ntoskrnl/se/priv.c
index a1013b1844b..ffab568d492 100644
--- a/ntoskrnl/se/priv.c
+++ b/ntoskrnl/se/priv.c
@@ -562,6 +562,7 @@ SeReleaseLuidAndAttributesArray(
         (PreviousMode != KernelMode || CaptureIfKernel))
     {
         ExFreePoolWithTag(Privilege, TAG_LUID);
+        Privilege = NULL;
     }
 }

diff --git a/ntoskrnl/se/sid.c b/ntoskrnl/se/sid.c
index 509b3777488..d6c0f4ad912 100644
--- a/ntoskrnl/se/sid.c
+++ b/ntoskrnl/se/sid.c
@@ -776,6 +776,7 @@ SeReleaseSidAndAttributesArray(
         ((AccessMode != KernelMode) || CaptureIfKernel))
     {
         ExFreePoolWithTag(CapturedSidAndAttributes, TAG_SID_AND_ATTRIBUTES);
+        CapturedSidAndAttributes = NULL;
     }
 }

diff --git a/ntoskrnl/se/token.c b/ntoskrnl/se/token.c
index fa4a0e8d847..a2a232343a7 100644
--- a/ntoskrnl/se/token.c
+++ b/ntoskrnl/se/token.c
@@ -3,7 +3,7 @@
  * LICENSE:         GPL-2.0-or-later (https://spdx.org/licenses/GPL-2.0-or-later)
  * PURPOSE:         Security token implementation support
  * COPYRIGHT:       Copyright David Welch [e-mail]
- *                  Copyright 2021 George Bișoc [e-mail]
+ *                  Copyright 2021-2022 George Bișoc [e-mail]
  */

/* INCLUDES *******************************************************************/
@@ -6819,8 +6819,6 @@ Quit:
         SeReleaseSidAndAttributesArray(CapturedSids,
                                        PreviousMode,
                                        TRUE);
-
-        CapturedSids = NULL;
     }

if (CapturedPrivileges != NULL)
@@ -6828,8 +6826,6 @@ Quit:
         SeReleaseLuidAndAttributesArray(CapturedPrivileges,
                                         PreviousMode,
                                         TRUE);
-
-        CapturedPrivileges = NULL;
     }

if (CapturedRestrictedSids != NULL)
@@ -6837,8 +6833,6 @@ Quit:
         SeReleaseSidAndAttributesArray(CapturedRestrictedSids,
                                        PreviousMode,
                                        TRUE);
-
-        CapturedRestrictedSids = NULL;
     }

return Status;