header-logo
Suggest Exploit
vendor:
Google Security Research
by:
Google Security Research
N/A
CVSS
N/A
Buffer Overflow
119
CWE
Product Name: Google Security Research
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: YES
Related CWE: Unknown
CPE: Unknown
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
Unknown

Pool Buffer Overflow in win32k!vSolidFillRect

The PoC triggers a pool buffer overflow in win32k!vSolidFillRect. When using Special Pool we get the crash immediately on the overwrite. Without Special Pool we often get a crash in the same function, but sometimes it crashes in a different function (similar to another issue, however with a different offset). This might be a result of the memory corruption or an out-of-memory condition before the overflow is triggered.

Mitigation:

Apply the latest security patches and updates to the system.
Source

Exploit-DB raw data:

Source: https://code.google.com/p/google-security-research/issues/detail?id=313

The PoC triggers a pool buffer overflow in win32k!vSolidFillRect. ​When using Special Pool we get the crash immediately on the overwrite. Without Special Pool we often get a crash in the same function, but sometimes it crashes in a different function (similar to another issue, however with a different offset). This might be a result of the memory corruption or an out-of-memory condition before the overflow is triggered. Debugger output for all three different crashes attached.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38270.zip

Navigation

Suggest Exploit

Services By CQR