Slashdot Mirror
MS Traces Duqu Zero-Day To Font Parsing In Win32k
yuhong writes "MS has traced the Duqu zero-day to a vulnerability in font parsing in win32k. Many file formats like HTML, Office, and PDF support embedded fonts, and in NT4 and later fonts are parsed in kernel mode! Other possible attack vectors, for example, include web pages visited using web browsers that support embedded fonts without the OTS font sanitizer (which recent versions of Firefox and Chrome have adopted)." Adds reader Trailrunner7: "This is the first time that the exact location and nature of the flaw has been made public. Microsoft said that the permanent fix for the new vulnerability will not be ready in time for next week's November patch Tuesday release."
If you remember what 3.5 and 3.51 were like, it's possible to have some sympathy for this, but IIRC it was highlighted at the time as a bit of a silly thing to do.
FFS microsoft, I'm a highschooler and I think that a really bad idea. How do mistakes like that get through q&a?
Whiskey Tango Foxtrot Microsoft. What genius thought font parsing belonged in ring 0?
Remember kids, it's all fun and games until someone commits wholesale galactic genocide.
http://support.mozilla.com/en-US/kb/Changing%20fonts%20and%20colors
Read that page.
@Mindless Drivel: 100% of Twitter posts ever Tweeted.
In fact it does. For example fbcon is part of kernel and handles, along other things, text rendering. It's not wise to assume things.
Besides, font rendering is quite common task and needs to be fast. That's why it also needs to be so low level. Yes, you could isolate everything to higher levels, but that only results in bloat and slowness. This was especially true in NT4.0 days, which this exploit dates back from.
... And I want at least one of them to give a good reason why parsing fonts in kernel mode is a good idea. Speed is not a good reason. Not even on 10 year old equipment it's not.
--
BMO
in NT4 and later fonts are parsed in kernel mode!
anyone who doesn't immediately realize this is a recipe for trouble? Parsing externally-supplied data in kernel mode. Yeah, like that never got anyone...
For all the really, really smart people that MS employes, why do they keep on making the dumbest mistakes one could come up with if it were a "dumb idea of the month" challenge?
Assorted stuff I do sometimes: Lemuria.org
The kernel doesn't parse fonts. A userspace program parses the fontfile (which could easily be TrueType if someone feels like supporting that, though it would have to be monospaced). The kernel only gets a raw monochrome bitmap data array for the characters, a width and height, and optionally a character map. No parsing is done in the kernel.
KDFONTOP ioctl arguments: /* KD_FONT_OP_* */ /* KD_FONT_FLAG_* */ /* font data with height fixed to 32 */
struct console_font_op {
unsigned int op;
unsigned int flags;
unsigned int width, height;
unsigned int charcount;
unsigned char *data;
};
fbcon blitting rectangular blobs onto the screen doesn't even remotely qualify as "parsing fonts". Doing TrueType in the kernel, which is what Windows does here, is patently insane.
Isn't this how people hacked the original xbox so many years ago (a font vulnerability)? It's not like they haven't been warned...
Oh, go ahead, mod me down
I wish people would for your karma whoring. The "mod me down" is a standard trick to get modded up on Slashdot.
Security? Why would that even appear on the radar?
Computer security has been an issue since at least the 1960s, and it's been well-documented and understood since at least the 1980s (when the NSA Rainbow Books appeared). The Morris worm hit in 1988. None of this stuff should have come as a surprise, and there were many people talking about how Microsoft was repeating all the mistakes over and over again.
As you say, the fact is, Microsoft wasn't concerned with security. I don't give them a free pass for that. The entire world has been paying for their mistakes ever since. Their lackadaisical attitude towards security -- when they certainly could have learned from the literature and from history -- has cost the world billions, if not trillions of dollars.
Not okay.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
in NT4 and later fonts are parsed in kernel mode
Sometimes I feel like I must be the only geezer remaining who actually had the opportunity to use NT 3.51, so let me tell you: It was a GLORIOUS operating system.
EVERYTHING was client/server, and all the client stuff ran in Ring 3/User Mode.
Heck, you could even kill Windows, and run it as a multi-user "DOS" box.
But, of course, that meant that the video/graphics subsystem also ran as a client service, in User Mode, which [I guess] the suits perceived as being "slow", and therefore as being an impediment to the gaming experience which would come with the impending merger of code bases that we now know as Windows XP [2001].
So in 1996, some genius at MSFT decided to throw out all of the beauty and elegance and stability and security that had been NT 3.51, and to serve up, instead, the great big steaming pile of sh!t which was NT 4.0 [with its video/graphics subsystem subsumed into the kernel].
And the world was never again the same...