search

AN-Master / google-security-research

Automatically exported from code.google.com/p/google-security-research
0 stars 0 forks source link

Windows kernel: buffer overflow in win32k!vSolidFillRect #313

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
Credit is to "Nils Sommer of bytegeist, working with Google Project Zero".

I confirmed this myself in a Win7 32-bit VM (2048MB RAM).

---
The PoC triggers a pool buffer overflow in win32k!vSolidFillRect. ​When using 
Special Pool we get the crash immediately on the overwrite. Without Special 
Pool we often get a crash in the same function, but sometimes it crashes in a 
different function (similar to another issue, however with a different offset). 
This might be a result of the memory corruption or an out-of-memory condition 
before the overflow is triggered. Debugger output for all three different 
crashes attached.

---

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by cev...@google.com on 31 Mar 2015 at 6:24

Attachments:

GoogleCodeExporter commented 8 years ago

Original comment by cev...@google.com on 31 Mar 2015 at 8:29

GoogleCodeExporter commented 8 years ago 
Same root cause as 
https://code.google.com/p/google-security-research/issues/detail?id=312, 
according to Microsoft. CVE shared.

Original comment by cev...@google.com on 4 Jun 2015 at 9:28

GoogleCodeExporter commented 8 years ago 
https://technet.microsoft.com/library/security/MS15-061

Original comment by cev...@google.com on 9 Jun 2015 at 5:55

GoogleCodeExporter commented 8 years ago

Original comment by haw...@google.com on 21 Sep 2015 at 9:49