4 ms·

Some of the Win32 GDI functions have been kernel-mode since NT4 for performance reasons (closer to the graphics driver). As for the font problem, the on-going

by jrabone 14y ago

Some of the Win32 GDI functions have been kernel-mode since NT4 for performance reasons (closer to the graphics driver). As for the font problem, the on-going saga of KB2753842 may be to blame: http://support.microsoft.com/kb/2753842 http://support.microsoft.com/kb/2753842 It looks like MS have had a few attempts at tightening up the potential for security exploits caused by executing what can effectively be untrusted code (the glyph program) in kernel space. This is why fonts are considered system components - they are code, not data, executing on a VM. If you like MS conspiracy theories of course, you can pretend that it's a deliberate ploy to break LibreOffice, but personally I think that's tin-foil hat territory. Most likely there's a bug in the GDI code triggered by an unusual glyph in the font (perhaps in turn generated by a bug in whatever font design software was used). Complexity + poor choice of performance optimisation = fail. At least the kernel bug check is working as designed - if only all OSes were so robust in the face of memory corruption.

chris_wot 14y ago
Hi, I filed the bug. I definitely don't think that Microsoft deliberately went out of their way to cause issues for LibreOffice. I am surprised that they basically allow untrusted input like a font to be passed to a kernel function, which can then cause the kernel to panic. I don't think I've seen any kernel deal directly with fonts. I understand the reasoning they added the GDI to kernel space, but IMHO it seems to me that they should seriously reconsider their reasoning. At the very least, they need to relook at their glyph parsing/building algorithm and perhaps look into better fuzz testing around these routines. Just my 2c :-)
wbl 14y ago
We have a crash caused by memory writes in the kernel. What part of this doesn't suggest kernel mode exploitation via a cleverly-crafted font that can be embedded into a web page or PDF? Font bugs should result in errors, not BSODs. Untrusted code on a VM is easy to secure: make the VM do nothing more then draw some glyphs, and check every access!
- yuhong 14y ago
  Assuming the rest of the code is perfect. Remember Duqu?
derleth 14y ago
> This is why fonts are considered system components - they are code, not data, executing on a VM. Like Javascript in a web page?
- jrabone 14y ago
  A browser's Javascript VM typically doesn't run in ring 0, unless you've got it badly wrong.
  - derleth 14y ago
    > A browser's Javascript VM typically doesn't run in ring 0, unless you've got it badly wrong. MSIE is an integral part of Windows. Microsoft has always said so.
    - chris_wot 14y ago
      Not every part of Windows runs in ring 0.
CamperBob2 14y ago
If you like MS conspiracy theories of course, you can pretend that it's a deliberate ploy to break LibreOffice If they hadn't done the same sort of thing before, it would sound like a conspiracy theory. Since they have, well... DOS isn't done 'til Lotus won't run, right?

by jrabone 14y ago

chris_wot 14y ago

Hi, I filed the bug. I definitely don't think that Microsoft deliberately went out of their way to cause issues for LibreOffice. I am surprised that they basically allow untrusted input like a font to be passed to a kernel function, which can then cause the kernel to panic. I don't think I've seen any kernel deal directly with fonts. I understand the reasoning they added the GDI to kernel space, but IMHO it seems to me that they should seriously reconsider their reasoning. At the very least, they need to relook at their glyph parsing/building algorithm and perhaps look into better fuzz testing around these routines. Just my 2c :-)

wbl 14y ago

We have a crash caused by memory writes in the kernel. What part of this doesn't suggest kernel mode exploitation via a cleverly-crafted font that can be embedded into a web page or PDF? Font bugs should result in errors, not BSODs. Untrusted code on a VM is easy to secure: make the VM do nothing more then draw some glyphs, and check every access!

yuhong 14y ago
Assuming the rest of the code is perfect. Remember Duqu?

derleth 14y ago

> This is why fonts are considered system components - they are code, not data, executing on a VM. Like Javascript in a web page?

jrabone 14y ago
A browser's Javascript VM typically doesn't run in ring 0, unless you've got it badly wrong.
- derleth 14y ago
  > A browser's Javascript VM typically doesn't run in ring 0, unless you've got it badly wrong. MSIE is an integral part of Windows. Microsoft has always said so.
  - chris_wot 14y ago
    Not every part of Windows runs in ring 0.

CamperBob2 14y ago

If you like MS conspiracy theories of course, you can pretend that it's a deliberate ploy to break LibreOffice If they hadn't done the same sort of thing before, it would sound like a conspiracy theory. Since they have, well... DOS isn't done 'til Lotus won't run, right?