Exploit-DB #47484
Description: Microsoft Windows Kernel - win32k.sys TTF Font Processing Pool Corruption in win32k!ulClearTypeFilter
Type: dos
Platform: windows
Date: 2019-10-10
Author: Google Security Research

Exploit:
We have encountered a Windows kernel crash in the win32k.sys driver while processing a corrupted TTF font file. An example crash log excerpt generated after triggering the bug is shown below:

--- cut ---
*** Fatal System Error: 0x00000050
                       (0xFFFFF900C1E1C003,0x[PII_REDACTED]000001,0xFFFFF9600006D2A8,0x[PII_REDACTED]000000)

Driver at fault: 
***    win32k.sys - Address FFFFF9600006D2A8 base at FFFFF[PII_REDACTED]0, DateStamp 5d0c4490

[...]

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffff900c1e1c003, memory referenced.
Arg2: [PII_REDACTED], value 0 = read operation, 1 = write operation.
Arg3: fffff9600006d2a8, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: [PII_REDACTED], (reserved)

[...]

TRAP_FRAME:  fffff880082791f0 -- (.trap 0xfffff880082791f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=[PII_REDACTED] rbx=[PII_REDACTED] rcx=fffff900c1e1bfb8
rdx=[PII_REDACTED]00000a rsi=[PII_REDACTED] rdi=[PII_REDACTED]
rip=fffff9600006d2a8 rsp=fffff[PII_REDACTED]0 rbp=[PII_REDACTED]00000c
 r8=fffff960002f5750  r9=[PII_REDACTED] r10=fffff900c1e1bfe9
r11=fffff900c1e1bff3 r12=[PII_REDACTED] r13=[PII_REDACTED]
r14=[PII_REDACTED] r15=[PII_REDACTED]
iopl=0         nv up ei pl nz na po nc
win32k!ulClearTypeFilter+0x214:
fffff960`0006d2a8 8807            mov     byte ptr [rdi],al ds:00000000`00000000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b65a22 to fffff80002ab1520

STACK_TEXT:  
fffff880`08278928 fffff800`02b65a22 : fffff900`c1e1c003 fffffa80`310f1b50 00000000`00000065 fffff800`02a82658 : nt!RtlpBreakWithStatusInstruction
fffff880`08278930 fffff800`02b66812 : fffff880`00000003 fffff880`082791f0 fffff800`02aba420 fffff880`08278f90 : nt!KiBugCheckDebugBreak+0x12
fffff880`08278990 fffff800`02aaada4 : 00000000`00000068 fffff880`[PII_REDACTED]`[PII_REDACTED]`00000000 : nt!KeBugCheck2+0x722
fffff880`08279060 fffff800`02b847b2 : 00000000`00000050 fffff900`c1e1c[PII_REDACTED]0`00000001 fffff880`082791f0 : nt!KeBugCheckEx+0x104
fffff880`082790a0 fffff800`02ab6ddc : 00000000`00000001 fffff900`c1e1c[PII_REDACTED]0`00000000 fffff900`c1e1bf94 : nt!MmAccessFault+0x2322
fffff880`082791f0 fffff960`0006d2a8 : 00000000`00000000 fffff800`00000001 fffff880`08279450 fffff900`c1e1bf94 : nt!KiPageFault+0x35c
fffff880`08279380 fffff960`0007097a : fffff900`c1a40010 fffff900`c1a40010 fffff880`[PII_REDACTED]`00000002 : win32k!ulClearTypeFilter+0x214
fffff880`08279400 fffff960`0006ce00 : fffff880`0827b67b fffff880`08279928 fffff900`c1b71010 fffff960`00000b70 : win32k!xInsertMetricsPlusRFONTOBJ+0x20e
fffff880`082794d0 fffff960`0006caa0 : fffff880`08279a00 fffff880`[PII_REDACTED]`[PII_REDACTED]`0000000a : win32k!RFONTOBJ::bGetGlyphMetricsPlus+0x1f0
fffff880`08279550 fffff960`0006c498 : 00000000`00000000 fffff880`082796f0 fffff900`c00cb[PII_REDACTED]0`00000008 : win32k!ESTROBJ::vCharPos_H3+0x168
fffff880`082795d0 fffff960`0006d955 : 00000000`[PII_REDACTED]`[PII_REDACTED]`00000007 fffff880`082796f0 : win32k!ESTROBJ::vInit+0x350
fffff880`08279660 fffff960`0006d5f7 : fffff880`08279b60 fffff900`c1a40010 fffffa80`[PII_REDACTED]`ffffffff : win32k!GreGetTextExtentExW+0x275
fffff880`08279920 fffff800`02ab8d53 : 00000000`5a010611 fffff880`00000b40 00000000`[PII_REDACTED]`00000000 : win32k!NtGdiGetTextExtentExW+0x237
fffff880`08279a70 00000000`74da204a : 00000000`74d8c46f 00000000`[PII_REDACTED]`74d8b[PII_REDACTED]0`002ff888 : nt!KiSystemServiceCopyEnd+0x13
00000000`001adca8 00000000`74d8c46f : 00000000`[PII_REDACTED]`74d8b[PII_REDACTED]0`002ff[PII_REDACTED]0`75ad5600 : wow64win!NtGdiGetTextExtentExW+0xa
00000000`001adcb0 00000000`74dcd18f : 00000000`002ff88c 00000000`7efdb[PII_REDACTED]0`7efdb[PII_REDACTED]0`7efdd000 : wow64win!whNtGdiGetTextExtentExW+0x43
00000000`001add00 00000000`74d52776 : 00000000`779a01e4 00000000`74dc0[PII_REDACTED]0`[PII_REDACTED]`002ffeec : wow64!Wow64SystemServiceEx+0xd7
00000000`001ae5c0 00000000`74dcd286 : 00000000`[PII_REDACTED]`74d5[PII_REDACTED]0`777d3[PII_REDACTED]0`7780c4f1 : wow64cpu!ServiceNoTurbo+0x2d
00000000`001ae[PII_REDACTED]0`74dcc69e : 00000000`[PII_REDACTED]`[PII_REDACTED]`74dc4b10 00000000`7ffe0030 : wow64!RunCpuSimulation+0xa
00000000`001ae6d0 00000000`778043c3 : 00000000`004f2d50 00000000`[PII_REDACTED]`77902e70 00000000`777d7550 : wow64!Wow64LdrpInitialize+0x42a
00000000`001aec20 00000000`77869780 : 00000000`[PII_REDACTED]`77876c7d 00000000`001af1d0 00000000`00000000 : ntdll!LdrpInitializeProcess+0x17e3
00000000`001af[PII_REDACTED]0`7781371e : 00000000`001af1d0 00000000`[PII_REDACTED]`7efdf[PII_REDACTED]0`00000000 : ntdll! ?? ::FNODOBFM::`string'+0x22790
00000000`001af[PII_REDACTED]0`00000000 : 00000000`[PII_REDACTED]`[PII_REDACTED]`[PII_REDACTED]`00000000 : ntdll!LdrInitializeThunk+0xe
--- cut ---

The type of the bugcheck implies a pool-based buffer overflow, potentially allowing for remote code execution in the context of the Windows kernel. While we have not determined the specific root cause of the vulnerability, we have pinpointed the offending mutations to reside in the "glyf", "hmtx" and "prep" tables.

The issue reproduces on Windows 7 and Windows Server 2008 R2 (64-bit), with and without Special Pools enabled for win32k.sys.

Attached is an archive with the proof-of-concept mu