Understanding Windows Kernel Font Scaler Engine Vulnerability

No ratings

Presented at Syscan360 2012 by

Wang Yu

The Font Scaler engine is widely used in Microsoft Windows and Mac OS operating systems for rendering TrueType / OpenType fonts. It was first introduced in early 1989.Later, to improve the performance of Windows NT system, Microsoft decided to move the engine from user mode to kernel mode. This adjustment does improve the performance, but it also introduces security issues. Font Scaler engine represents a significant kernel attack surface,and is perhaps the most easily accessible remotely. The famous Duqu malware exploits vulnerability in the engine. In this presentation we will discuss the design of the Font Scaler engine, and the security impact of implementing the engine in Windows kernel mode.