Microsoft Windows Kernel - Registry Hive Loading Negative RtlMoveMemory Size in nt!CmpCheckValueList (MS16-124)

Microsoft Windows Kernel - Registry Hive Loading Negative RtlMoveMemory Size in nt!CmpCheckValueList MS16-124 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=873 We have encountered Windows kernel crashes in the memmove function called by nt!CmpCheckValueList while loading...

Microsoft Windows Kernel - Registry Hive Loading Relative Arbitrary Read in nt!RtlValidRelativeSecurityDescriptor (MS16-123)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=876 We have encountered a Windows kernel crash in the nt!RtlValidRelativeSecurityDescriptor function invoked by nt!CmpValidateHiveSecurityDescriptors while loading corrupted registry hive files. An example of a crash log excerpt...

Microsoft Windows Kernel - win32k.sys TTF Processing EBLC EBSC Tables Pool Corruption (MS16-039)

Microsoft Windows Kernel - win32k.sys TTF Processing EBLC EBSC Tables Pool Corruption MS16-039 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=684 We have encountered a Windows kernel crash in the win32k.sys driver while processing a corrupted TTF font file. An example of a cras...

Microsoft Windows Kernel - 'win32k.sys' TTF Processing EBLC / EBSC Tables Pool Corruption (MS16-039)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=684 We have encountered a Windows kernel crash in the win32k.sys driver while processing a corrupted TTF font file. An example of a crash log excerpt generated after triggering the bug is shown below: --- BADPOOLHEADER 19 The pool ...

Microsoft Windows Kernel - 'NtGdiGetTextExtentExW' Out-of-Bounds Memory Read

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=685 The attached Proof-of-Concept crashes Windows 7 with special pool enabled on win32k.sys. The crash is due accessing memory past the end of a buffer. Proof of Concept:...

MS16-005: Description of the security update for Windows kernel-mode drivers: January 12, 2016

None None...

Microsoft Windows Kernel win32k!OffsetChildren - Null Pointer Dereference

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=544 The attached PoC triggers a null pointer vulnerability in OffsetChildren on Windows 7 32-bit. By mapping the null page an attacker can leverage this vulnerability to...

Microsoft Windows Kernel - win32k!OffsetChildren Null Pointer Dereference

Microsoft Windows Kernel - win32k!OffsetChildren Null Pointer Dereference Source: https://code.google.com/p/google-security-research/issues/detail?id=544 The attached PoC triggers a null pointer vulnerability in OffsetChildren on Windows 7 32-bit. By mapping the null page an attacker can leverage...

Microsoft Windows Kernel - 'win32k!OffsetChildren' Null Pointer Dereference

Source: https://code.google.com/p/google-security-research/issues/detail?id=544 The attached PoC triggers a null pointer vulnerability in OffsetChildren on Windows 7 32-bit. By mapping the null page an attacker can leverage this vulnerability to write to an arbitrary address. --- Proof of Concept...

Microsoft Windows Kernel - Device Contexts and NtGdiSelectBitmap Use-After-Free (MS15-115)

Source: https://code.google.com/p/google-security-research/issues/detail?id=505 The attached testcase triggers a use-after-free condition in win32k. The attached debugger output was triggered on Windows 7 with Special Pool enabled on win32k.sys. --- Proof of Concept:...

Microsoft Windows Kernel - win32k.sys Malformed TrueType Program TTF Font Processing Pool-Based Buffer Overflow (MS15-115)

Microsoft Windows Kernel - win32k.sys Malformed TrueType Program TTF Font Processing Pool-Based Buffer Overflow MS15-115 Source: https://code.google.com/p/google-security-research/issues/detail?id=507 We have observed a number of Windows kernel crashes in the win32k.sys driver while processing...

Microsoft Windows Kernel - 'win32k.sys' Malformed TrueType Program TTF Font Processing Pool-Based Buffer Overflow (MS15-115)

Source: https://code.google.com/p/google-security-research/issues/detail?id=507 We have observed a number of Windows kernel crashes in the win32k.sys driver while processing corrupted TTF font files. An example of a crash log excerpt generated after triggering the bug is shown below: ---...

Microsoft Windows Kernel - bGetRealizedBrush Use-After-Free (MS15-097)

Microsoft Windows Kernel - bGetRealizedBrush Use-After-Free MS15-097 Source: https://code.google.com/p/google-security-research/issues/detail?id=458 --- The attached testcase crashes Win 7 with Special Pool on win32k while accessing freed memory in bGetRealizedBrush​​. --- Proof of Concept:...

Microsoft Windows Kernel - UserCommitDesktopMemory Use-After-Free (MS15-073)

Microsoft Windows Kernel - UserCommitDesktopMemory Use-After-Free MS15-073 Source: https://code.google.com/p/google-security-research/issues/detail?id=335 Freed memory is accessed after switching between two desktops of which one is closed. The testcase crashes with and without special pool...

Microsoft Windows Kernel - DeferWindowPos Use-After-Free (MS15-073)

Microsoft Windows Kernel - DeferWindowPos Use-After-Free MS15-073 Source: https://code.google.com/p/google-security-research/issues/detail?id=339 The attached PoC demonstrate a use-after-free condition that occurs when operating on a DeferWindowPos object from multiple threads. The DeferWindowPos...

Microsoft Windows Kernel - 'NtGdiStretchBlt' Pool Buffer Overflow (MS15-097)

Source: https://code.google.com/p/google-security-research/issues/detail?id=415 --- Tested on Win 7 32-bit with Special Pool enabled. Multiple pool buffer overflows can be triggered through the NtGdiStretchBlt system call. The attached PoC demonstrates a write overflow and another read over flow...

Microsoft Windows Kernel - Null Pointer Dereference with Window Station and Clipboard (MS15-061)

Source: https://code.google.com/p/google-security-research/issues/detail?id=294 Platform: Win7 32-bit. trigger.cpp should fire the issue, with a caveat - PoC might NOT work if compiled as a debug build. windbg.txt is a sample crash log. Analysis from Nils: --- please find attached a C trigger,...

Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (1)

Source: https://code.google.com/p/google-security-research/issues/detail?id=293 Platform: Win7 32-bit. trigger.cpp should fire the issue, with two caveats: - PoC will NOT work if compiled as a debug build. - PoC will trigger the condition every time but the subsequent corruption might not cause a...

Microsoft Windows Kernel - Use-After-Free with Cursor Object (MS15-097)

Microsoft Windows Kernel - Use-After-Free with Cursor Object MS15-097 Source: https://code.google.com/p/google-security-research/issues/detail?id=457 --- The attached testcase crashes Win 7 with Special Pool enabled while accessing the freed global cursor object gpqCursor​. See poc.cpp for...

Microsoft Windows Kernel - Use-After-Free with Cursor Object (MS15-097)

Source: https://code.google.com/p/google-security-research/issues/detail?id=457 --- The attached testcase crashes Win 7 with Special Pool enabled while accessing the freed global cursor object gpqCursor. See poc.cpp for instructions on how to compile and run. Proof of Concept:...