Submission Report

Submission Report

January 25, 2019 19:54
Updated

Submission Reports give DOH and Health System Administrators insight into the validity of records submitted to CDX from various departments under their management. To view the Submission Report for your system, go to Reports : Submission Report .
To filter submission reports by date, use the From and To date selection fields. To filter submission reports by department, click in the Department field and select the appropriate department from the drop-down list. When these filters are used, individually or in combination, the list updates to include only the submissions meeting the specified criteria.
Note : The departments available in the drop-down list are customized for your state.
From any page, go to Reports : Submission Report . The Submission Report page opens.
To view late submissions, go to the Late column for the desired month and click the number link. A list of departments with late data submissions opens.
To view partial submissions, go to the Partial column for the desired month and click the number link. A list of departments with partial data submissions opens.
To view missing submissions, go to the Missing column for the desired month and click the number link. A list of departments with missing data submissions opens.
Optionally, to switch between late, partial, and missing submissions, use the drop-down menu at the top right.
Click a department name to view details specific to that department.
Period The submission report details for a certain month and year as well as the total number of departments involved.
Late – The number of late submissions for the designated month and year. Click the number to view the departments with late submissions and, optionally, send an email to department administrators .
Partial – The number of partial submissions for the designated month and year. Click the number to view the departments with partial submissions and, optionally, send an email to department administrators .
Complete – The number of completed submissions for the designated month and year.
NDR – The number of departments with an NDR (No Data Reported) exception .
Perm. Exceptions – The number of departments granted a permanent exception for their data submission.
Note : A permanent exception does not mean an exemption, but it does not set a due date for the submission.
Temp. Exceptions – The number of departments granted a temporary exception for their data submission. A temporary exception always includes a due date for the submission.
Missing – The number of departments with missing demographic information. Click the number to view departments with missing demographic submissions and, optionally, send an email to department administrators .
Submitted – The number of departments with accurately submitted demographic information.
Low – The number of departments with a low and failing validation score. Click the number to view departments with low validation scores.
Acceptable – The number of departments with an acceptable validation score.

More

Home

Report an issue

Report Security Vulnerability

Report Abuse

Report Infringement

Submission FAQs

Customer guidance

Security Update Guide

Exploitability index

Developer API documentation

Frequently Asked Questions

Technical Security Notifications

Engage

Microsoft Bug Bounty Programs

Microsoft Active Protections Program

BlueHat Security Conference

Researcher Recognition Program

Windows Security Servicing Criteria

Who we are

Mission

Cyber Defense Operations Center

Coordinated Vulnerability Disclosure

Social

Blogs

Microsoft Security Response Center

Security Research & Defense

BlueHat Conference Blog

Acknowledgments

Security Researcher Acknowledgments

Online Services Researcher Acknowledgments

Security Researcher Leaderboard

All Microsoft

Microsoft 365

Teams

Windows

Surface

Xbox

Deals

Small Business

Support

Software
Software

Windows Apps

OneDrive

Outlook

Skype

OneNote

Microsoft Teams

Microsoft Edge

PCs & Devices
PCs & Devices

Computers

Shop Xbox

Accessories

VR & mixed reality

Phones

Entertainment
Entertainment

Xbox Game Pass Ultimate

PC Game Pass

Xbox games

PC games

Windows digital games

Movies & TV

Business
Business

Microsoft Cloud

Microsoft Security

Dynamics 365

Microsoft 365 for business

Microsoft Power Platform

Windows 365

Microsoft Industry

Small Business

Developer & IT
Developer & IT

Azure

Developer Center

Documentation

Microsoft Learn

Microsoft Tech Community

Azure Marketplace

AppSource

Visual Studio

Other
Other

Microsoft Rewards

Free downloads & security

Education

Virtual workshops and training

Gift cards

Students and parents deals

Licensing

Microsoft Experience Center

View Sitemap

Sandboxed Mount Reparse Point Creation Mitigation Bypass
Windows 10 (build 10240), earlier versions do not have the functionality
A mitigation added to Windows 10 to prevent NTFS Mount Reparse Points being created at integrity levels below medium can be bypassed.
Windows 10 has added some new mitigations to block the creation or change the behaviour of certain symbolic links when issued by a low integrity/sandboxed process. The presumed aim to make it harder to abuse these types of tricks to break out of a sandbox.
In earlier builds on Windows 10 NTFS Mount Reparse Points were blocked outright from a sandboxed process, however in 10240 (what can only be assumed a final build) the check was moved to the kernel in IopXXXControlFile and changed slightly so that sandboxed processes could create some mount points. The check is roughly:
if(ControlCode == FSCTL_SET_MOUNT_POINT) { 
if (FsRtlValidateReparsePointBuffer(buffer) && buffer->ReparseTag == TAG_MOUNT_POINT) { 
NTSTATUS status = ZwOpenFile(..., buffer->ReparseTarget, FILE_GENERIC_WRITE, ... , FILE_DIRECTORY_FILE); 
if (!NT_SUCCESS(status)) { 
The kernel is therefore checking that the target of the mount point is a directory and that the current process has write access to the directory. This would sufficiently limit the ability of a sandboxed process to abuse this to write files at a higher privilege. Unfortunately there’s a perhaps unexpected problem with this check, the sandboxed process can redirect the ZwOpenFile call arbitrarily to something it can open for write, yet the original value is set as the mount point. This is because the file open check is being made inside the process which is doing the call which means it honours the user’s device mapping.
While the sandboxed process cannot change the per-user drive mappings, it can change the process’s device map using NtSetInformationProcess with the ProcessDeviceMap information class. As we can create arbitrary object directories and symbolic links (which while they also have a mitigation it only prevents a higher privilege process following them, which we don’t care about) we can build a completely fake device map which redirects the open to another directory. A good target turns out to be \Device\NamedPipe\ (note the trailing slash) as that can be opened from any privilege level (including Chrome renderer processes) for write access and as a directory. So if we want to set an arbitrary mount point to say \??\c:\somewhere we can build something like:
(DIR) -> C:(DIR) -> somewhere(LINK to \Device\NamedPipe\)
If we set the unnamed directory to the process device map we can bypass the check and create the mount point.
Perhaps from a fix perspective you could query for the opened path and use that to write to the NTFS reparse point rather than using the original value.
I’ve provided a PoC which will demonstrate the bypass. It should be executed at low integrity using psexec or modifying the executable file’s ACL to low. Ensure you use the correct version for the architecture on Windows, as there seems to be a bug in NtSetInformationProcess which blocks Wow64 apps from setting the process device map. You can compare the operation to the command shell’s mklink tool that will fail to create the mount point at low integrity. Follow these steps:
1) Extract the PoC to a location on a local hard disk which is writable by a normal user.
2) Execute the poc executable file as low integrity passing two arguments, the path to a directory to create (must be somewhere than can be written to as low integrity user such as AppData\Temp\Low) and the arbitrary file path to set the mount point to. For example:

poc.exe c:\users\user\appdata\local\low\abc c:\notreal.
It shouldn’t be possible to create a mount point pointed at a location not writable by low integrity user
The mount point is created successfully.
Special thanks to James Forshaw for his consistent, high-quality submissions to the Microsoft Security Response Center.
the local kernel stack var KernerStackStuctVar is uninitialized. 
and direcly copy to usermode after call _GreSfmGetDirtyRgn@40. 
.text:0008718A ; int __stdcall NtGdiHLSurfGetInformation(int, int, void *, int) 
.text:0008718A public _NtGdiHLSurfGetInformation@16 
.text:0008718A _NtGdiHLSurfGetInformation@16 proc near 
.text:0008718A KernerStackStuctVar = dword ptr -58h 
.text:0008729F lea ecx, [ebp+KernerStackStuctVar] 
.text:000872A4 call _memcpy ; xxxx 
"v": "win32kfull!NtGdiHLSurfGetInformation+0x11f" 

English (United States)

Sitemap

Contact Microsoft

Privacy

Manage cookies

Terms of use

Trademarks

Safety & eco

About our ads

© Microsoft 2022

Microsoft strives to address reported vulnerabilities as quickly as possible. One of the factors that influences the time to address a vulnerability is how long it takes to assess the root cause, severity, and impact of the vulnerability. In practice, the amount of time it takes Microsoft to assess a vulnerability is heavily influenced by the quality of the information provided with a vulnerability report.
To help security researchers better understand the information we need to accelerate the assessment of a vulnerability, we’ve defined three quality levels for a vulnerability report: low, medium, and high. These quality levels are summarized in the table below. We encourage everyone to provide high quality reports whenever possible and our bounty programs typically incentivize this by offering higher rewards for higher quality reports.
While we prefer high quality reports, we always want to learn about vulnerabilities that affect Microsoft, so we encourage researchers to report vulnerabilities even if they are not able to provide the highest level of quality.
A low quality vulnerability report provides sufficient information to reproduce the vulnerability but does not include a reliable proof of concept.
A medium quality vulnerability report improves upon a low quality report by providing a proof of concept that is reliable and minimized.
A high quality vulnerability report improves upon a medium quality report by providing a detailed and correct analysis of the vulnerability.
A classification of the type of vulnerability being reported, such as Use After Free, Cross-Site Scripting, and so on. For examples of vulnerability types, it may be helpful to refer to https://nvd.nist.gov/vuln/categories .
The component or service that is affected by the vulnerability. This should include the component’s name and any relevant version information.
The target environment that is affected by the vulnerability, such as the operating system or application that is affected. This should include a description of the target environment, including its name and any relevant version information.
For Windows targets, this should include the BuildLabEx string which can be found here:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BuildLabEx
The output from a successful reproduction of the vulnerability. This could consist of debugger output, a screenshot, a video, or some other format that demonstrates a reproduction of the issue. More detailed information like debugger output is preferred.
A description of the vulnerability in the form of text, code, or other form depending on the nature of the vulnerability. This description should include all steps required to trigger the vulnerability. Any information about how the target needs to be configured to trigger the vulnerability should also be included.
Reliable & minimized proof-of-concept
A proof-of-concept that reproduces the vulnerability automatically (e.g. with code) when applicable. This proof-of-concept should:
This analysis should correctly describe how each part of the proof-of-concept affects the target in terms of triggering the vulnerability. In addition, the analysis should include information about how timing, environment, or other constraints affect successfully triggering the vulnerability. This analysis should also describe the root cause of the vulnerability, to the degree possible.
# win32kfull!NtGdiHLSurfGetInformation+0x11f kernel info leak 

Type of vulnerability
Affected component (name, version)
Affected target environment (type, version)
Vulnerability reproduction output (debugger output, screenshot, etc)
Proof-of-concept

All information required by a low quality report
Reliable & minimized proof-of-concept

All information required by a medium quality report
Detailed & correct analysis

Reality Kings Mom And Son
Mom Son Teen
Arab Massage Sex

Submission Report

Report Page