Adobe Acrobat Reader DC – Heap-Based Memory Corruption due to Malformed TTF Font

• Exploit Database
• 110 阅读

• 作者： Google Security Research
  日期： 2019-12-11
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/47769/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90

  We have observed the following access violation exception in the latest version of Adobe Acrobat Reader DC for Windows, when opening a malformed PDF file:   --- cut --- First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=707779e0 ebx=25876c38 ecx=052faab8 edx=707703a4 esi=707703d4 edi=25876e34 eip=10e6c29e esp=052fa89c ebp=052fa8a4 iopl=0 nv up ei pl nz ac po nc cs=0023ss=002bds=002bes=002bfs=0053gs=002b efl=00210212 CoolType!CTInit+0x3913e: 10e6c29e 8902mov dword ptr [edx],eaxds:002b:707703a4=31a03194   0:000> u @eip-14 CoolType!CTInit+0x3912a: 10e6c28a 8b7d0cmov edi,dword ptr [ebp+0Ch] 10e6c28d 8b571cmov edx,dword ptr [edi+1Ch] 10e6c290 8b7720mov esi,dword ptr [edi+20h] 10e6c293 035508add edx,dword ptr [ebp+8] 10e6c296 8b4724mov eax,dword ptr [edi+24h] 10e6c299 037508add esi,dword ptr [ebp+8] 10e6c29c 03c6add eax,esi 10e6c29e 8902mov dword ptr [edx],eax   0:000> ? poi(edi+1c) Evaluate expression: -690332 = fff57764   0:000> ? poi(ebp+8) Evaluate expression: 1887538240 = 70818c40   0:000> !heap -p -a 70818c40 address 70818c40 found in _DPH_HEAP_ROOT @ bfc1000 in busy allocation (DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize) 723d3b94: 70818c40173c0 - 7081800019000 unknown!fillpattern 0f32a8d0 verifier!AVrfDebugPageHeapAllocate+0x00000240 77f24b26 ntdll!RtlDebugAllocateHeap+0x0000003c 77e7e3e6 ntdll!RtlpAllocateHeap+0x000000f6 77e7cfb7 ntdll!RtlpAllocateHeapInternal+0x000002b7 77e7ccee ntdll!RtlAllocateHeap+0x0000003e 0f48aa2f vrfcore!VfCoreRtlAllocateHeap+0x0000001f 77c2f1f6 ucrtbase!_malloc_base+0x00000026 5fbefc39 AcroRd32!AcroWinMainSandbox+0x00003ec9 10e37991 CoolType!CTInit+0x00004831 10e38e1b CoolType!CTInit+0x00005cbb 10e68870 CoolType!CTInit+0x00035710 10e683dc CoolType!CTInit+0x0003527c 10e67d25 CoolType!CTInit+0x00034bc5 10e65902 CoolType!CTInit+0x000327a2 10e633f2 CoolType!CTInit+0x00030292 10e62719 CoolType!CTInit+0x0002f5b9 10e620e8 CoolType!CTInit+0x0002ef88 10e62000 CoolType!CTInit+0x0002eea0 108f36f1 AGM!AGMInitialize+0x0002a881   0:000> kb # ChildEBP RetAddrArgs to Child WARNING: Stack unwind information not available. Following frames may be wrong. 00 052fa8a4 10e6bde2 70818c40 25876e34 70818c40 CoolType!CTInit+0x3913e 01 052fa918 10e6bd06 052faab4 052fa9e4 00000001 CoolType!CTInit+0x38c82 02 052fa930 10e6bce7 052faab4 052fa9e4 73330f68 CoolType!CTInit+0x38ba6 03 052fa944 10e6bb4f 052faab4 052fa9e4 73330f68 CoolType!CTInit+0x38b87 04 052fa968 10e6b8b0 052facd8 73330f68 110f7080 CoolType!CTInit+0x389ef 05 052fab08 10e6abf9 73330f68 110f7080 052facd8 CoolType!CTInit+0x38750 06 052fad64 10e65b0c 052fb054 052faddc 00000000 CoolType!CTInit+0x37a99 07 052fb07c 10e633f2 000007c6 00000000 00000000 CoolType!CTInit+0x329ac 08 052fb14c 10e62719 65babff0 00000001 052fb1dc CoolType!CTInit+0x30292 09 052fb964 10e620e8 6aa0a9b4 052fb97c 6aa0a990 CoolType!CTInit+0x2f5b9 0a 052fb9e4 10e62000 6aa0a9b4 6aa0a99c 73fdc4da CoolType!CTInit+0x2ef88 0b 052fba24 108f36f1 7155bd90 6aa0a9b4 6aa0a99c CoolType!CTInit+0x2eea0 0c 052fba38 108e023e 6aa0a99c 108e01d0 331cbd80 AGM!AGMInitialize+0x2a881 0d 052fba4c 108df007 331cbd8c 10d84a18 00000001 AGM!AGMInitialize+0x173ce 0e 052fba84 108f0bcc c1574612 1733a7d0 00000000 AGM!AGMInitialize+0x16197 0f 052fbb4c 0f327c7a 0bfc16cc 052fbb78 0f3291ab AGM!AGMInitialize+0x27d5c --- cut ---   Notes:   - The crash looks very similar to the one reported in Issue #1891 in June 2019, and fixed in August 2019 as CVE-2019-8042. The stack trace and context are nearly identical. It is possible that this is an unfixed variant of the previous vulnerability.   - Reproduces on Adobe Acrobat Reader DC (2019.012.20040) on Windows 10, with and without PageHeap enabled (more cleanly with PageHeap, though).   - The crash occurs immediately after opening the PDF document, and is caused by an attempt to write data at a negative offset relative to a heap allocation (-690332 in the above case).   - Attached samples: poc[1-4].pdf (crashing files).     Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47769.zip