microsoft / microsoft/terminal

FreeConsole API handle UAF/recycling issue

Open
#18,909 3 comments 0 reactions 0 assignees View on GitHub
Impact-Correctness Issue-Bug Priority-3 Product-Conhost zInbox-Bug
Dominant language
C++
Stars
105k
Forks
9.6k
Avg merge
3d 17h
Merged PRs (30d)
29

Description

### Windows build number

10.0.10240.0

### Other Software

N/A

### Steps to reproduce

Windows 10 and 11 have an issue where the FreeConsole function closes the StandardInput, StandardOutput, StandardError and ConsoleHandle fields in the PEB but doesn't zero these values.

Windows recycles handle identifiers and since these values are not zeroed when they're closed, they start referencing an entirely different handle.

### Expected Behavior

The FreeConsole function zero the StandardInput, StandardOutput, StandardError and ConsoleHandle fields in the PEB after closing the handle.

### Actual Behavior

The FreeConsole function closes the handles but doesn't zero the StandardInput, StandardOutput, StandardError and ConsoleHandle fields in the PEB causing a use-after-free scenario.

### Sample

This sample project reproduces two separate issues:
[Project1.zip](https://github.com/user-attachments/files/20200428/Project1.zip)

You should hit this breakpoint when running the sample:
[Screenshot](https://github.com/user-attachments/assets/0f9a161e-b7ae-42f5-9af9-db1c135c77e5)

Otherwise if you hit this breakpoint from kernelbase/msvcrt then run the sample a few more times. kernelbase/msvcrt is calling GetStdHandle and unexpectedly referencing a process handle - from the sample - due to FreeConsole not zeroing the StandardInput, StandardOutput, StandardError and ConsoleHandle fields in the PEB:

![Image](https://github.com/user-attachments/assets/9c0d8064-63a9-45a6-b504-b96c89d082a2)

It's the same issue but less obvious.

Contributor guide

Open the contributing guide

Research direction

Start by running the linked Project1.zip sample on the reported Windows builds and inspect the FreeConsole and GetStdHandle behavior described in the reproduction steps. Determine whether this belongs in the Windows Terminal codebase or requires an upstream Windows fix; done would require a confirmed fix with the sample no longer observing recycled handles.

Written by the indexing model from the issue text.

Assessment

Domain
cli, operating-systems
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.