6 ms·

ATMFD strikes again, and undoubtedly not for the last time. More info on the history of ATMFD (and some previous vulnerabilities): https://googleprojectzero.bl

ATMFD strikes again, and undoubtedly not for the last time. More info on the history of ATMFD (and some previous vulnerabilities): https://googleprojectzero.blogspot.com/2015/07/one-font-vulnerability-to-rule-them-all.html https://googleprojectzero.blogspot.com/2015/07/one-font-vuln...

r00fus 7y ago
Is there no way to simply remove this DLL or is it too widely used in core Windows?
- wolfi1 7y ago
  it is essential for the rendering of postscript fonts. there is no replacement for it, unfortunately
  - jfk13 7y ago
    On the other hand, many of us could probably live without any postscript fonts.
    - wolfi1 7y ago
      until you open a pdf file
      - jfk13 7y ago
        Depends on the PDFs you're interested in. Many use only embedded TrueType (Type42) fonts, which I assume are handled by the usual Microsoft renderer. (If you're reading lots of LaTeX-generated papers, then yes, you're probably seeing PostScript fonts.)
- blattimwind 7y ago
  This is part of the huge and unending clusterfuck of vulnerabilities that people find in the Windows graphics stack, which was wisely moved to kernel space early on in NT's life, which makes all these vulnerabilities much more critical than they would be otherwise.
  - pixel16 7y ago
    Graphics hasn't been kernel mode since the Vista days FYI. It's now in userspace.
    - jdsully 7y ago
      It was moved out in Vista with great fanfare. A side effect was GDI was no longer hardware accelerated. With windows 7 and later hardware acceleration was added back necessitating parts of it return to the kernel. For obvious reasons this wasn't as widely publicized. This makes exploits like this possible: https://sensepost.com/blog/2017/abusing-gdi-objects-for-ring0-primitives-revolution/ https://sensepost.com/blog/2017/abusing-gdi-objects-for-ring...
      - dman 7y ago
        I thought GDI is now emulated over Direct2D.
        jdsully 7y ago
        You draw to a DirectX surface rather than the raw frame buffer but it is by no means translated to D2D. D2D has a "GDI" emulation mode, but it's more than worthless if you care about rendering fidelity with the real thing - and you probably do if your still on GDI these days.
        dman 7y ago
        Ah good to know - I was under the incorrect impression that the D2D "GDI" emulation mode was the only codepath remaining. Btw any pointers on how to keep track of the graphics stack in Windows? In the past there used to be a treasure trove of blogs and content in MSDN but over time that community has frittered away. Any pointers on how to keep track of what Microsofts graphics roadmap is going forward?
        jdsully 7y ago
- acqq 7y ago
  > Is there no way to simply remove this DLL There is: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200006 https://portal.msrc.microsoft.com/en-US/security-guidance/ad... Microsoft documents, as a possibility, how to "Rename ATMFD.DLL" and describes the impact.
- gruez 7y ago
  It doesn't seem to be part of windows. A clean install doesn't have the file. It's probably only an issue if you have adobe flash/reader installed.
  - Tempest1981 7y ago
    See this comment https://news.ycombinator.com/item?id=22670577 https://news.ycombinator.com/item?id=22670577
- AdrianB1 7y ago
  There is one and it is mentioned in the article.
- jlgaddis 7y ago
  As noted in a bullet point in TFA, one workaround is to: > Rename ATMFD.DLL, or alternatively, disable the file from the registry Caveat: > Renaming ATMFD.DLL, the last recommended stopgap, will cause display problems for applications that rely on embedded fonts and could cause some apps to stop working if they use OpenType fonts. Also from TFA: > Monday’s advisory provides detailed instructions for both turning on and turning off all three workarounds.
nightfly 7y ago
"a kernel-mode Adobe Type Manager Font Driver" this is just such a crazy idea.
- Someone1234 7y ago
  It is an old idea. Back when "put everything in the kernel to make it fast" was the forefront of computing technology. Microsoft obviously still has work to do but they did take a large chunk of sound and graphics code out of kernel space in Vista.
  - IshKebab 7y ago
    And to be fair, putting graphics stuff in the kernel allows Windows to do some graphical things properly, like a secure attention key (ctrl-alt-delete to log in) and a proper task manager. Linux can't really do either of those things nicely because graphics is just another program. Although I'm sure you can isolate your don't decoding better than shoving it in the kernel.
    - kohtatsu 7y ago
      Euh, I think a secure attention key is fine; you only have that chord sent to a designated trusted process; preventing other processes from being able to react to it and mimic an auth dialog. Am I missing something?
      - lonelappde 7y ago
        Parent said SAK is good.
        deleted 7y ago
        [deleted]
        kohtatsu 7y ago
        Sorry that was ambiguous wording; I was addressing their statement it was harder to do without the graphics being in the kernel.

r00fus 7y ago

Is there no way to simply remove this DLL or is it too widely used in core Windows?

wolfi1 7y ago
it is essential for the rendering of postscript fonts. there is no replacement for it, unfortunately
- jfk13 7y ago
  On the other hand, many of us could probably live without any postscript fonts.
  - wolfi1 7y ago
    until you open a pdf file
    - jfk13 7y ago
      Depends on the PDFs you're interested in. Many use only embedded TrueType (Type42) fonts, which I assume are handled by the usual Microsoft renderer. (If you're reading lots of LaTeX-generated papers, then yes, you're probably seeing PostScript fonts.)
blattimwind 7y ago
This is part of the huge and unending clusterfuck of vulnerabilities that people find in the Windows graphics stack, which was wisely moved to kernel space early on in NT's life, which makes all these vulnerabilities much more critical than they would be otherwise.
- pixel16 7y ago
  Graphics hasn't been kernel mode since the Vista days FYI. It's now in userspace.
  - jdsully 7y ago
    It was moved out in Vista with great fanfare. A side effect was GDI was no longer hardware accelerated. With windows 7 and later hardware acceleration was added back necessitating parts of it return to the kernel. For obvious reasons this wasn't as widely publicized. This makes exploits like this possible: https://sensepost.com/blog/2017/abusing-gdi-objects-for-ring0-primitives-revolution/ https://sensepost.com/blog/2017/abusing-gdi-objects-for-ring...
    - dman 7y ago
      I thought GDI is now emulated over Direct2D.
      - jdsully 7y ago
        You draw to a DirectX surface rather than the raw frame buffer but it is by no means translated to D2D. D2D has a "GDI" emulation mode, but it's more than worthless if you care about rendering fidelity with the real thing - and you probably do if your still on GDI these days.
        dman 7y ago
        Ah good to know - I was under the incorrect impression that the D2D "GDI" emulation mode was the only codepath remaining. Btw any pointers on how to keep track of the graphics stack in Windows? In the past there used to be a treasure trove of blogs and content in MSDN but over time that community has frittered away. Any pointers on how to keep track of what Microsofts graphics roadmap is going forward?
        jdsully 7y ago
acqq 7y ago
> Is there no way to simply remove this DLL There is: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200006 https://portal.msrc.microsoft.com/en-US/security-guidance/ad... Microsoft documents, as a possibility, how to "Rename ATMFD.DLL" and describes the impact.
gruez 7y ago
It doesn't seem to be part of windows. A clean install doesn't have the file. It's probably only an issue if you have adobe flash/reader installed.
- Tempest1981 7y ago
  See this comment https://news.ycombinator.com/item?id=22670577 https://news.ycombinator.com/item?id=22670577
AdrianB1 7y ago
There is one and it is mentioned in the article.
jlgaddis 7y ago
As noted in a bullet point in TFA, one workaround is to: > Rename ATMFD.DLL, or alternatively, disable the file from the registry Caveat: > Renaming ATMFD.DLL, the last recommended stopgap, will cause display problems for applications that rely on embedded fonts and could cause some apps to stop working if they use OpenType fonts. Also from TFA: > Monday’s advisory provides detailed instructions for both turning on and turning off all three workarounds.

nightfly 7y ago

"a kernel-mode Adobe Type Manager Font Driver" this is just such a crazy idea.

Someone1234 7y ago
It is an old idea. Back when "put everything in the kernel to make it fast" was the forefront of computing technology. Microsoft obviously still has work to do but they did take a large chunk of sound and graphics code out of kernel space in Vista.
- IshKebab 7y ago
  And to be fair, putting graphics stuff in the kernel allows Windows to do some graphical things properly, like a secure attention key (ctrl-alt-delete to log in) and a proper task manager. Linux can't really do either of those things nicely because graphics is just another program. Although I'm sure you can isolate your don't decoding better than shoving it in the kernel.
  - kohtatsu 7y ago
    Euh, I think a secure attention key is fine; you only have that chord sent to a designated trusted process; preventing other processes from being able to react to it and mimic an auth dialog. Am I missing something?
    - lonelappde 7y ago
      Parent said SAK is good.
      - deleted 7y ago
        [deleted]
      - kohtatsu 7y ago
        Sorry that was ambiguous wording; I was addressing their statement it was harder to do without the graphics being in the kernel.