Tag Archive for: graphics
Google shares PoC exploit for critical Windows 10 Graphics RCE bug
Project Zero, Google’s 0day bug-hunting team, shared technical details and proof-of-concept (PoC) exploit code for a critical remote code execution (RCE) bug affecting a Windows graphics component.
The Project Zero researchers discovered the vulnerability, tracked as CVE-2021-24093, in a high-quality text rendering Windows API named Microsoft DirectWrite.
They reported the bug to the Microsoft Security Response Center in November. The company released security updates to address it on all vulnerable platforms on February 9, during this month’s Patch Tuesday.
Impacts Windows 10 versions up to 20H2
The security flaw impacts multiple Windows 10 and Windows Server releases up to version 20H2, the latest released version.
After the 90-day disclosure deadline, Project Zero published a proof-of-concept exploit code that can be used to reproduce the bug in browsers running on fully-patched Windows 10 1909 systems.
“Attached is the proof-of-concept TrueType font together with an HTML file that embeds it and displays the AE character,” the researchers said.
“It reproduces the crash shown above on a fully updated Windows 10 1909, in all major web browsers. The font itself has been subset to only include the faulty glyph and its dependencies.”
Microsoft DirectWrite heap-based buffer overflow in fsg_ExecuteGlyph while processing variable TTF fonts https://t.co/EM4zxsIXwK
— Project Zero Bugs (@ProjectZeroBugs) February 24, 2021
From heap-based buffer overflow to RCE
The DirectWrite API is used as the default font rasterizer by major web browsers such as Chrome, Firefox, and Edge for rendering web font glyphs.
Since these web browsers use the DirectWrite API for font rendering, the security flaw can be leveraged by attackers to trigger a memory corruption state that may allow them to execute arbitrary code on the targets’ systems remotely.
Attackers can exploit CVE-2021-24093 by tricking targets into visiting websites with maliciously crafted TrueType fonts that trigger a heap-based buffer overflow in the fsg_ExecuteGlyph API function.
Google patched a similar actively exploited zero-day in the popular FreeType text rendering library used to target Chrome users.
In November,…
Nvidia Graphics Driver Vulnerabilities Allow Hackers To Spy On Your PC
Nvidia has released new drivers for its graphics cards, which fix several security problems that open the doors to a potential attacker.
The company confirmed that the latest driver update actually covers six security holes that have not been made public until now.
The problem actually affects the controllers, or drivers, that allow strangers to access the system due to various bugs that can lead to denial of service, privilege escalation, data manipulation, or information filtering.
When Nvidia released version 461.09 of its ‘Game Ready’ drivers for graphics cards this week, there was some surprise among the community; these drivers are digitally signed as WHQL, something that happens only with the most important versions that include more news.
However, a glance at what’s new list for these drivers tells us that they are not very important — fixed some relatively minor issues, including one that caused a blue screen when three 4K monitors are connected. But it was striking that there was no information on improvements or compatibility with new games, as is usual.
That’s because Nvidia has actually released these new drivers to fix six serious security issues; the most dangerous of all has a CVSS vulnerability score of 8.4, for offering a possible attacker the escalation of privileges, accessing and taking control of the computer.
There is a lot of confusion in the way Nvidia has not discussed these issues; Although it has made them public, they only appear in Nvidia’s monthly security bulletin, a document that the vast majority of users do not consult.
If you have seen that there is an update and that it only fixes a few bugs, you may have thought that it is not worth updating; many users actually avoid it, because sometimes an update can degrade performance or introduce new bugs.
But this is one of those cases in which you have to update even if it does not seem so important. The bugs discovered are very serious, although it must be clarified that taking advantage of them is not so easy.
It is advisable to install the update to version 461.09, which includes the patches, and which can be downloaded from the official Nvidia website.
Free photos, graphics site Freepik discloses data breach impacting 8.3m users – ZDNet
Free photos, graphics site Freepik discloses data breach impacting 8.3m users ZDNet
“data breach” – read more