Malformed CFF Vulnerability

Malformed CFF Vulnerability

Vulnerability in FreeType
Software	iOS iPod Software
Vulnerable versions	iOS 3.1.2 - 4.0.1 (iPhone/iPod touch) iOS 3.2 - 3.2.1 (iPad) iPod nano (6th and 7th generation) Software
Fixed in version	iOS 4.0.2 (iPhone/iPod touch) iOS 3.2.2 (iPad)
Disclosed	1 August 2010 (2010-08-01)
Discovered by	comex
CVE	CVE-2010-1797
Apple KB	iOS 4.0.2: 103586 iOS 3.2.2: 103586

The Malformed CFF Vulnerability, along with the IOSurface Kernel Exploit, was used in Star/JailbreakMe 2.0. It is a stack overflow in the handling of CFF opcodes. Contrary to popular belief, it is not a vulnerability within the PDF parser, although the malformed font was placed in a PDF for exploitation.

On 31 December 2023 (2023-12-31), the freemyipod project announced the successful use of this vulnerability to achieve unsigned code execution on the iPod nano (6th and 7th generation) for the first time. A proof-of-concept exploit was released on GitHub as ipod_sun.

The package PDF Patch was released on Telesphoreo to fix the vulnerability on devices jailbroken on a vulnerable version.

Fix

The following patch was used to fix the bug:

diff -u -r freetype-2.4.1/src/cff/cffgload.c freetype-2.4.1_patched/src/cff/cffgload.c
--- freetype-2.4.1/src/cff/cffgload.c	2010-07-15 09:26:45.000000000 -0700
@@ -204,7 +204,7 @@
    2, /* hsbw */
    0,
    0,
-    0,
+    1,
    5, /* seac */
    4, /* sbw */
    2  /* setcurrentpoint */
@@ -2041,6 +2041,9 @@
            if ( Rand >= 0x8000L )
              Rand++;

+            if ( args - stack >= CFF_MAX_OPERANDS )
+                goto Stack_Overflow;
+			  
            args[0] = Rand;
            seed    = FT_MulFix( seed, 0x10000L - seed );
            if ( seed == 0 )
@@ -2166,6 +2169,9 @@
        case cff_op_dup:
          FT_TRACE4(( " dup\n" ));

+          if ( args + 1 - stack >= CFF_MAX_OPERANDS )
+            goto Stack_Overflow;
+                
          args[1] = args[0];
          args += 2;
          break;