Slashdot Mirror

← Back to Stories (view on slashdot.org)

MS Traces Duqu Zero-Day To Font Parsing In Win32k

Posted by timothy on from the if-only-smarts-and-ethics-went-together dept.

yuhong writes "MS has traced the Duqu zero-day to a vulnerability in font parsing in win32k. Many file formats like HTML, Office, and PDF support embedded fonts, and in NT4 and later fonts are parsed in kernel mode! Other possible attack vectors, for example, include web pages visited using web browsers that support embedded fonts without the OTS font sanitizer (which recent versions of Firefox and Chrome have adopted)." Adds reader Trailrunner7: "This is the first time that the exact location and nature of the flaw has been made public. Microsoft said that the permanent fix for the new vulnerability will not be ready in time for next week's November patch Tuesday release."

2 of 221 comments (clear)

  1. There are a lot of Microsoft shills here... by bmo · · Score: 5, Insightful

    ... And I want at least one of them to give a good reason why parsing fonts in kernel mode is a good idea. Speed is not a good reason. Not even on 10 year old equipment it's not.

    --
    BMO

  2. Re:Kernel mode by marcansoft · · Score: 5, Informative

    The kernel doesn't parse fonts. A userspace program parses the fontfile (which could easily be TrueType if someone feels like supporting that, though it would have to be monospaced). The kernel only gets a raw monochrome bitmap data array for the characters, a width and height, and optionally a character map. No parsing is done in the kernel.

    KDFONTOP ioctl arguments:
    struct console_font_op {
                    unsigned int op; /* KD_FONT_OP_* */
                    unsigned int flags; /* KD_FONT_FLAG_* */
                    unsigned int width, height;
                    unsigned int charcount;
                    unsigned char *data; /* font data with height fixed to 32 */
    };

    fbcon blitting rectangular blobs onto the screen doesn't even remotely qualify as "parsing fonts". Doing TrueType in the kernel, which is what Windows does here, is patently insane.