Microsoft CMD.EXE Integer Overflow

Microsoft's CMD.EXE suffers from an integer overflow vulnerability that can cause a denial of service.

SHA-256 | 0dd89aa95efb736688b5ffc10611f37891e22e136b3e6479a503952ce6a9f6e3

Hi @ll,

the subject says it all: a 25 year old TRIVIAL signed integer
arithmetic bug (which may well have earned a PhD now) crashes
Windows' command interpreter CMD.exe via its builtin SET command.
See their documentation:


CWE-190: Integer Overflow or Wraparound

CWE-248: Uncaught Exception


On Windows NT4 or any newer version start the command interpreter and
run the following 4 command lines (the first 3 set just the base):

SET /A -2147483648
SET /A ~2147483647
SET /A ~2147483647 / -1
SET /A ~2147483647 % -1

[1] Oops: although a valid signed 32-bit integer, the command interpreter
reports the literal value -2147483648 = 2**31 alias INT_MIN as
"Invalid number. Numbers are limited to 32-bits of precision."

[2] As expected, ~2147483647, the negation of INT_MAX, yields INT_MIN

[3] Also as expected, computing the quotient of INT_MIN / -1 produces
"Invalid number. Numbers are limited to 32-bits of precision.": the
correct result is +2147483648 alias INT_MAX + 1, i.e. produces a
integer overflow, which raises a #DE (divide error) exception on
x86/x64 processors (and their 8- and 16-bit predecessors too).

[4] OUCH: rather unexpected, computing the remainder of INT_MIN / -1
crashes the command processor with the #DE exception, i.e.
the developers failed to implement the check they used for

JFTR: the remainder of <any integer> % -1 as well as <any integer> % 1
is (by the algebraic definition of division) 0 (in words: ZERO):
the remainder is in magnitude less than the divisor.
The only integer that is in magnitude less than |-1| = 1 is 0!


Setting one or both of the following documented registry entries
crashes the command interpreter upon invocation (unless started
with the switch /D):

[HKEY_CURRENT_USER\Software\Microsoft\Command Processor]
"AutoRun"="SET /A ~2147483647 % ~0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor]
"AutoRun"="SET /A ~2147483647 % ~0"

stay tuned
Stefan Kanthak

PS: I reported this bug as DoS to the MSRC; they replied with the
following bullshit statement in their 2nd sentence:

| Though engineering confirmed the crash in this case, it was assessed
| as a Low severity DoS.
| Their reasoning centers around the requirement to have admin
| privileges to pull off the attack.

OUCH! Unprivileged users can but write this registry entry below
[HKEY_CURRENT_USER\Software\Microsoft\Command Processor]

Related Posts