Google shares PoC exploit for critical Windows 10 Graphics RCE bug

Google shares PoC exploit for critical Windows 10 Graphics RCE bug

Project Zero, Google’s 0day bug-hunting team, shared technical details and proof-of-concept (PoC) exploit code for a critical remote code execution (RCE) bug affecting a Windows graphics component.

The Project Zero researchers discovered the vulnerability, tracked as CVE-2021-24093, in a high-quality text rendering Windows API named Microsoft DirectWrite.

They reported the bug to the Microsoft Security Response Center in November. The company released security updates to address it on all vulnerable platforms on February 9, during this month’s Patch Tuesday.

Impacts Windows 10 versions up to 20H2

The security flaw impacts multiple Windows 10 and Windows Server releases up to version 20H2, the latest released version.

After the 90-day disclosure deadline, Project Zero published a proof-of-concept exploit code that can be used to reproduce the bug in browsers running on fully-patched Windows 10 1909 systems.

“Attached is the proof-of-concept TrueType font together with an HTML file that embeds it and displays the AE character,” the researchers said.

“It reproduces the crash shown above on a fully updated Windows 10 1909, in all major web browsers. The font itself has been subset to only include the faulty glyph and its dependencies.”

From heap-based buffer overflow to RCE

The DirectWrite API is used as the default font rasterizer by major web browsers such as Chrome, Firefox, and Edge for rendering web font glyphs.

Since these web browsers use the DirectWrite API for font rendering, the security flaw can be leveraged by attackers to trigger a memory corruption state that may allow them to execute arbitrary code on the targets’ systems remotely.

Attackers can exploit CVE-2021-24093 by tricking targets into visiting websites with maliciously crafted TrueType fonts that trigger a heap-based buffer overflow in the fsg_ExecuteGlyph API function.

Google patched a similar actively exploited zero-day in the popular FreeType text rendering library used to target Chrome users.

In November,…


G Data Internet Security 2014 review

Ryuk ransomware now self-spreads to other Windows LAN devices

Ryuk ransomware now self-spreads to other Windows LAN devices

A new Ryuk ransomware variant with worm-like capabilities that allow it to spread to other devices on victims’ local networks has been discovered by the French national cyber-security agency while investigating an attack in early 2021.

“Through the use of scheduled tasks, the malware propagates itself – machine to machine – within the Windows domain,” ANSSI (short for Agence Nationale de la Sécurité des Systèmes d’Information) said in a report published today.

“Once launched, it will thus spread itself on every reachable machine on which Windows RPC accesses are possible.”

Self-replication to other network devices

To propagate itself over the local network, the new Ryuk variant lists all the IP addresses in the local ARP cache and sends what looks like Wake-on-LAN (WOL) packets to each of the discovered devices. It then mounts all sharing resources found for each device so that it can encrypt the contents.

Ryuk’s ability to mount and encrypt remote computers’ drives was previously observed by Advanced Intelligence CEO Vitali Kremez last year.

What makes this new Ryuk sample different is its capability to copy itself to other Windows devices on the victims’ local networks.

Additionally, it can execute itself remotely using scheduled tasks created on each subsequently compromised network host with the help of the legitimate schtasks.exe Windows tool.

The Ryuk variant analyzed in this document does have self-replication capabilities. The propagation is achieved by copying the executable on identified network shares. This step is followed by the creation of a scheduled task on the remote machine. [..] Some filenames were identified for this copy: rep.exe and lan.exe. – ANSSI

Example scheduled task
Example scheduled task (BleepingComputer)

While it doesn’t use an exclusion mechanism that would prevent it from re-encrypting devices, ANSSI says that the new variant can still be blocked from infecting other hosts on the network by changing the password of the privileged domain account it uses for propagation to other hosts.

“One way to tackle the problem could be to change the password or disable the user account (according to the used account) and then proceed to a double KRBTGT domain password…


Emsisoft Internet Security pack 9 final test and review