Vulnerability in Microsoft Font Driver Could Allow Remote Code Execution

Re:Vulnerability in Microsoft Font Driver Could Allow Remote... by blinkingled on Monday July 20, 2015 @03:38PM (#9918456)

Excellent blog post by Mateusz Jurczyk of Google Project Zero on how the ATMFD DLL vulnerability was discovered and how an exploit POC was developed is here - http://j00ru.vexillium.org/?p=2520

Especially read the linked PDF if you love pain and misery but enjoy understanding complex stuff :)

[ Parent | on HN ]

Re:Vulnerability in Microsoft Font Driver Could Allow Remote... by PhantomGremlin on Monday July 20, 2015 @06:04PM (#9919425)

I've only skimmed the PDF so far.

There was one great observation I couldn't resist repeating. The font renderer is performing various checks to validate 'n', the count of arguments passed on the stack, to a particular function. However:

   Turns out, a negative value of n passes all the checks!

Oops. It's possible to use this bug to target memory well beyond the stack. It's game over!

The best bugs are the simplest bugs.

[ Parent | on HN ]

Re:Vulnerability in Microsoft Font Driver Could Allow Remote... by blinkingled on Monday July 20, 2015 @06:12PM (#9919459)

Yeah that's true but as you will find later, it really wasn't anywhere near easy to develop an exploit that results in code execution despite of that simple bug. This one just results in BugCheck - attempted X of NX memory.

[ Parent | on HN ]