Understanding TOCTTOU in the Windows Kernel Font Scaler Engine
summary
Finds a concrete TOCTTOU exploitation path in the Windows kernel Font Scaler: kernel code precomputes sizes for CG3/CG4, double‑fetches user buffers, and a first overwrite of CG3 cascades into a CVE-2011-3402 CVT count domino overwrite that corrupts interpreter state; Duqu’s exploit uses thousands of TrueType VM instructions to implement a signature search via a ITP flip trick uses thousands of TrueType VM instructions. Recompiles the engine as FS engine user‑mode recompile to reproduce behavior, and builds a kernel monitoring tool that logs copy_from_user-style accesses and validates the attack; PoC works and Microsoft patches follow.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 1:15Background
- 2:38Time of Use
- 3:16Why
- 4:17How
- 10:43State Structure
- 13:04Changing Font File
- 16:00Changing Character Code
- 17:48Executing VM Instructions
- 18:48Conclusions
- 20:58Questions
- 22:49Data Structure
- 24:01Memory Allocation
- 26:57Advanced Exploit Techniques
- 28:48Understanding TOCTTOU
- 31:33First Overrated
- 34:04Summary
- 39:04Drawing a Picture
- 39:23FSAC Routine
- 39:53BoxBone
- 40:45While Loop
- 47:04Patch Tuesday
- 48:05MAF
- 48:47Log
- 50:21Precompute
- 51:16GDI
- 52:14Graph
related talks
46mD2T2 - Over The Edge: Pwning The Windows Kernel
35mRacing the Dark: A New TOCTTOU Story From Apple's Core
52mA New CVE-2015-0057 Exploit Technology
46mFor The Win: The Art Of The Windows Kernel Fuzzing
40mCommSec D1 - The Life & Death of Kernel Object Abuse
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
40mDirty Bin Cache: A New Code Injection Poisoning Binary Translation Cache
39mTOCTOU Attacks Against Secure Boot And BootGuard