-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - Orange Bat advisory -

Name             : VMWare Workstation (hcmon.sys 6.0.0.45731)
Class            : DoS
Published       : 2008-08-17
Credit        : g_ (g_ # orange-bat # com)

- - Details -

Fails to sanitize pointers sent from usermode with METHOD_NEITHER.

hcmon.sys:

.text:00011606 loc_11606:                             .text:00011606                 mov     eax, [ebp+SystemBuffer]
.text:00011609                 mov     [ebp+SystemBuffer2], eax
.text:0001160C                 mov     ecx, [ebp+SystemBuffer2]
.text:0001160F                 mov     edx, [ecx+0Ch]       <---- BUGCHECK
.text:00011612                 cmp     edx, [ebp+var_20]
.text:00011615                 jnz     short loc_11629
.text:00011617                 cmp     [ebp+NumberOfBytes], 70h
.text:0001161B                 jb      short loc_11629
.text:0001161D                 mov     eax, [ebp+SystemBuffer2]
.text:00011620                 cmp     dword ptr [eax+8], 7FFBh
.text:00011627                 jbe     short loc_11638

This code can be reached by sending 0x8101232B IOCTL to \\.\hcmon
device.

- - Proof of concept -

#include <windows.h>
#include <stdio.h>
#include <ddk/ntifs.h>