{"action":"created","issue":{"url":"https://api.github.com/repos/dongAxis/google-security-research/issues/473","labels_url":"https://api.github.com/repos/dongAxis/google-security-research/issues/473/labels{/name}","comments_url":"https://api.github.com/repos/dongAxis/google-security-research/issues/473/comments","events_url":"https://api.github.com/repos/dongAxis/google-security-research/issues/473/events","html_url":"https://github.com/dongAxis/google-security-research/issues/473","id":94925807,"number":473,"title":"atmfd NamedEscape(0x2514) buffer-underflow vulnerability","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dongAxis/google-security-research/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/dongAxis/google-security-research/labels/CCProjectZeroMembers","name":"CCProjectZeroMembers","color":"ededed"},{"url":"https://api.github.com/repos/dongAxis/google-security-research/labels/Deadline-7","name":"Deadline-7","color":"ededed"},{"url":"https://api.github.com/repos/dongAxis/google-security-research/labels/Deadline-Exceeded","name":"Deadline-Exceeded","color":"ededed"},{"url":"https://api.github.com/repos/dongAxis/google-security-research/labels/Finder-external","name":"Finder-external","color":"ededed"},{"url":"https://api.github.com/repos/dongAxis/google-security-research/labels/Product-win32k","name":"Product-win32k","color":"ededed"},{"url":"https://api.github.com/repos/dongAxis/google-security-research/labels/Reported-2015-Jul-1","name":"Reported-2015-Jul-1","color":"ededed"},{"url":"https://api.github.com/repos/dongAxis/google-security-research/labels/Severity-High","name":"Severity-High","color":"ededed"},{"url":"https://api.github.com/repos/dongAxis/google-security-research/labels/Vendor-Microsoft","name":"Vendor-Microsoft","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-07-14T11:31:25Z","updated_at":"2015-07-21T20:57:48Z","closed_at":null,"body":"```\n\nA buffer-underflow vulnerability exists when using NamedEscape(0x2514) in atmfd.\n\nkd> kv\nChild-SP          RetAddr           : Args to Child                             \n                              : Call Site\nfffff880`059e8458 fffff800`02ac4e69 : 00000000`0000003b 00000000`c0000005 \nfffff960`00197fac fffff880`059e8d20 : nt!KeBugCheckEx\nfffff880`059e8460 fffff800`02ac47bc : fffff880`059e94c8 fffff880`059e8d20 \n00000000`00000000 fffff800`02af1630 : nt!KiBugCheckDispatch+0x69\nfffff880`059e85a0 fffff800`02af113d : fffff800`02ceb248 fffff800`02c23514 \nfffff800`02a51000 fffff880`059e94c8 : nt!KiSystemServiceHandler+0x7c\nfffff880`059e85e0 fffff800`02aeff15 : fffff800`02c1931c fffff880`059e8658 \nfffff880`059e94c8 fffff800`02a51000 : nt!RtlpExecuteHandlerForException+0xd\nfffff880`059e8610 fffff800`02b00e81 : fffff880`059e94c8 fffff880`059e8d20 \nfffff880`00000000 00000000`00000001 : nt!RtlDispatchException+0x415\nfffff880`059e8cf0 fffff800`02ac4f42 : fffff880`059e94c8 00000000`00000000 \nfffff880`059e9570 fffff900`c3f81000 : nt!KiDispatchException+0x135\nfffff880`059e9390 fffff800`02ac3aba : 00000000`00000000 00000000`00000008 \n00000000`00000400 00000000`00000000 : nt!KiExceptionDispatch+0xc2\nfffff880`059e9570 fffff960`00197fac : 00000000`00000001 fffff900`c3f81000 \n00000000`00000001 42424242`41414141 : nt!KiPageFault+0x23a (TrapFrame @ \nfffff880`059e9570)\nfffff880`059e9700 fffff960`001a0411 : 00000000`00000000 00000000`00000001 \nfffff900`c3f81000 fffff900`00000000 : win32k!SURFACE::bDeleteSurface+0x264\nfffff880`059e9850 fffff960`00197940 : 00000000`00000bac 00000000`00000000 \nfffff900`c1e05330 fffff900`00000000 : win32k!NtGdiCloseProcess+0x2c9\nfffff880`059e98b0 fffff960`00197087 : 00000000`00000000 00000000`00000001 \nfffffa80`074d7b50 00000000`00000001 : win32k!GdiProcessCallout+0x200\nfffff880`059e9930 fffff800`02d990cd : 00000000`00000000 00000000`00000000 \n00000000`00000000 fffffa80`074d7b00 : win32k!W32pProcessCallout+0x6b\nfffff880`059e9960 fffff800`02d7d2b0 : 00000000`00000000 00000000`00000001 \nfffffa80`06f42600 00000000`00000000 : nt!PspExitThread+0x4d1\nfffff880`059e9a60 fffff800`02ac4b53 : fffffa80`06f426e0 fffff880`00000000 \nfffffa80`074d7b50 00000000`00000000 : nt!NtTerminateProcess+0x138\nfffff880`059e9ae0 00000000`76f5de7a : 00000000`00000000 00000000`00000000 \n00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame \n@ fffff880`059e9ae0)\n00000000`0008e318 00000000`00000000 : 00000000`00000000 00000000`00000000 \n00000000`00000000 00000000`00000000 : 0x76f5de7a\n\n\nThis bug is subject to a 7 day disclosure deadline, as the issue is being \nexploited in the wild. If 7 days elapse without a broadly available patch, then \nthe bug report will automatically become visible to the public.\n\nA small testcase is attached.\n```\n\nOriginal issue reported on code.google.com by `tav...@google.com` on 2 Jul 2015 at 1:33\n\nAttachments:\n* [test.c](https://storage.googleapis.com/google-code-attachments/google-security-research/issue-473/comment-0/test.c)\n* [fontdata.h](https://storage.googleapis.com/google-code-attachments/google-security-research/issue-473/comment-0/fontdata.h)\n"},"comment":{"url":"https://api.github.com/repos/dongAxis/google-security-research/issues/comments/123475206","html_url":"https://github.com/dongAxis/google-security-research/issues/473#issuecomment-123475206","issue_url":"https://api.github.com/repos/dongAxis/google-security-research/issues/473","id":123475206,"user":{"login":"dnlongen","id":10099099,"avatar_url":"https://avatars.githubusercontent.com/u/10099099?v=3","gravatar_id":"","url":"https://api.github.com/users/dnlongen","html_url":"https://github.com/dnlongen","followers_url":"https://api.github.com/users/dnlongen/followers","following_url":"https://api.github.com/users/dnlongen/following{/other_user}","gists_url":"https://api.github.com/users/dnlongen/gists{/gist_id}","starred_url":"https://api.github.com/users/dnlongen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dnlongen/subscriptions","organizations_url":"https://api.github.com/users/dnlongen/orgs","repos_url":"https://api.github.com/users/dnlongen/repos","events_url":"https://api.github.com/users/dnlongen/events{/privacy}","received_events_url":"https://api.github.com/users/dnlongen/received_events","type":"User","site_admin":false},"created_at":"2015-07-21T20:57:48Z","updated_at":"2015-07-21T20:57:48Z","body":"This sounds like the issue addressed my MS15-078 - is it the same vulnerability?"}}