Discovered by Andrea Allievi and Piotr Bania of Cisco Talos.

Talos, in conjunction with Microsoft's security advisory issued on September 8th, is disclosing the discovery of a memory corruption vulnerability within the Microsoft Windows CDD Font Parsing Kernel Driver. This vulnerability was initially discovered by the Talos and reported in accordance with responsible disclosure policies to Microsoft. Please see Talos's Microsoft Tuesday Blog for coverage information for this vulnerability. Read the full Talos Vulnerability Report via the talosintel.com portal here: TALOS-2015-0007

Details

A specially crafted font file can cause the Microsoft Windows CDD Font Parsing Kernel driver to corrupt internal memory structures. The DrvTextOut routine acquires and locks the associated device and behaves differently based on the surface type. If the type is a bitmap and the Windows DWM is on, the driver will read and write directly to the video frame buffer and calls EngTextOut, then exits. However,the driver behaves in an unexpected mannerwhere a new background rect is generated mixing the "OpaqueRect" rectangle located in the sixth parameter and the rectangle located in the "pStringTextObj" object.

If the ClipObject describes a NON-Trivial clip, even the "rclBounds" of the clip object is merged to the background rectangle. The Font Object is parsed, and finally the routine decides if it should clip the background rect or not.

The final decision is based on the following check:

The ClipDstRect routine performs the actual clipping based on the complexity of the Clip object. If the complexity is DC_TRIVIAL, the CPU cache is flushed and the callback routine is called. However, the FillColorKeyCallback routine contains a flaw in that it doesn't properly check the width and height of the rectangle.

The problem is that the background rectangle is checked in the DrvTextOut routine but does not correctly handle the error condition.

Finding and disclosing zero-day vulnerabilities responsibly helps improve the overall security of the devices and software people use on a day-to-day basis.  Talos is committed to this effort via developing programmatic ways to identify problems or flaws that could be otherwise exploited by malicious attackers. These developments help secure the platforms and software customers use and also help provide insight into how Cisco can improve its own processes to develop better products.

For further zero day or vulnerability reports and information visit:

http://talosintel.com/vulnerability-reports/