Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Share Post: Reddit Facebook
Google shares PoC exploit for critical Windows 10 Graphics RCE bug
#1
Project Zero, Google's 0day bug-hunting team, shared technical details and proof-of-concept (PoC) exploit code for a critical remote code execution (RCE) bug affecting a Windows graphics component.
The Project Zero researchers discovered the vulnerability, tracked as CVE-2021-24093, in a high-quality text rendering Windows API named Microsoft DirectWrite.
They reported the bug to the Microsoft Security Response Center in November. The company released security updates to address it on all vulnerable platforms on February 9, during this month's Patch Tuesday.
Impacts Windows 10 versions up to 20H2
The security flaw impacts multiple Windows 10 and Windows Server releases up to version 20H2, the latest released version.
After the 90-day disclosure deadline, Project Zero published a proof-of-concept exploit code that can be used to reproduce the bug in browsers running on fully-patched Windows 10 1909 systems.
"Attached is the proof-of-concept TrueType font together with an HTML file that embeds it and displays the AE character," the researchers said.
"It reproduces the crash shown above on a fully updated Windows 10 1909, in all major web browsers. The font itself has been subset to only include the faulty glyph and its dependencies."

From heap-based buffer overflow to RCE
The DirectWrite API is used as the default font rasterizer by major web browsers such as Chrome, Firefox, and Edge for rendering web font glyphs.
Since these web browsers use the DirectWrite API for font rendering, the security flaw can be leveraged by attackers to trigger a memory corruption state that may allow them to execute arbitrary code on the targets' systems remotely.
Attackers can exploit CVE-2021-24093 by tricking targets into visiting websites with maliciously crafted TrueType fonts that trigger a heap-based buffer overflow in the fsg_ExecuteGlyph API function.
Google patched a similar actively exploited zero-day in the popular FreeType text rendering library used to target Chrome users.
In November, Microsoft also fixed a Windows kernel zero-day bug actively exploited in targeted attacks and publicly disclosed by Project Zero one month earlier.


Source
Reply
#2
Thanks for the post
Please use quotes.
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds mrtrout 0 1,019 11-25-2021 , 02:58 PM
Last Post: mrtrout
  ProtonMail Shares Activist's IP Address With Authorities Despite Its "No Log" Claims mrtrout 0 713 09-07-2021 , 06:03 AM
Last Post: mrtrout
  Scanning Activity Detected After Release of Exploit for Critical SAP SolMan Flaw Bjyda 0 881 01-24-2021 , 01:55 PM
Last Post: Bjyda
  Google Chrome fixes antivirus 'file locking' bug on Windows 10 mrtrout 0 1,057 01-04-2021 , 04:11 AM
Last Post: mrtrout
  Google Discloses Poorly-Patched, Now Unpatched, Windows 0-Day Bug Bjyda 0 820 12-25-2020 , 12:43 AM
Last Post: Bjyda

Forum Jump:


Users browsing this thread: 1 Guest(s)