Details
-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
None
-
None
Description
The NPFS driver in ReactOS lacks implementation for FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE and FSCTL_PIPE_SET_CONNECTION_ATTRIBUTE IOCTLs.
These are used for setting “extended attributes” on named pipe objects.
These attributes can be set by NPFS itself or other modules like SMB driver and can be read by kernel32 DLL.
WINE implements them incorrectly by returning the PID of the process who created the object, while it can be used to set any key/value pair.
The only publicly available documentation can be found in a Google Zero Day writeup: https://projectzero.google/2019/09/windows-exploitation-tricks-spoofing.html
This PR implements an APITEST for these IOCTLs: https://github.com/reactos/reactos/pull/9371
Related Issues: https://jira.reactos.org/browse/CORE-17834
This issue can be fixed by an implementation of FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE that returns the PID, just like WINE.