CVE-2012-2897

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e242c000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bf88ef08, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------


READ_ADDRESS:  e242c000 Paged pool

FAULTING_IP:
win32k!vGetVerticalGSet+46
bf88ef08 ff37            push    dword ptr [edi]

MM_INTERNAL_CODE:  1

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ff2f637

MODULE_NAME: win32k

FAULTING_MODULE: bf800000 win32k

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  csrss.exe

TRAP_FRAME:  b23a62e0 -- (.trap 0xffffffffb23a62e0)
ErrCode = 00000000
eax=00000000 ebx=e1e35d18 ecx=00000000 edx=00000000 esi=e23eb020 edi=e242c000
eip=bf88ef08 esp=b23a6354 ebp=b23a6364 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
win32k!vGetVerticalGSet+0x46:
bf88ef08 ff37            push    dword ptr [edi]      ds:0023:e242c000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 804f7b8b to 80527c24

STACK_TEXT:
b23a5e1c 804f7b8b 00000003 e242c000 00000000 nt!RtlpBreakWithStatusInstruction
b23a5e68 804f8778 00000003 00000000 c0712160 nt!KiBugCheckDebugBreak+0x19
b23a6248 804f8ca3 00000050 e242c000 00000000 nt!KeBugCheck2+0x574
b23a6268 8051cc4f 00000050 e242c000 00000000 nt!KeBugCheckEx+0x1b
b23a62c8 805405f4 00000000 e242c000 00000000 nt!MmAccessFault+0x8e7
b23a62c8 bf88ef08 00000000 e242c000 00000000 nt!KiTrap0E+0xcc
b23a6364 bf895168 e23aa010 fffefc0a e1acf7f8 win32k!vGetVerticalGSet+0x46
b23a69f8 bf8949aa e1f72a08 03000000 e23eb010 win32k!bLoadTTF+0x3a1
b23a6a80 bf8948e4 e1f72a08 012c0000 00067978 win32k!bLoadFontFile+0x230
b23a6ad0 bf8943ad 00000001 e1f72a00 e1fd47f8 win32k!ttfdSemLoadFontFile+0x4c
b23a6b00 bf89433b 00000001 e1f72a00 e1fd47f8 win32k!PDEVOBJ::LoadFontFile+0x3a
b23a6b38 bf89469e b23a6c88 00000013 e1f72a00 win32k!vLoadFontFileView+0x12b
b23a6bb4 bf89554e b23a6c88 00000013 00000001 win32k!PUBLIC_PFTOBJ::bLoadFonts+0x1da
b23a6bfc bf895480 b23a6c88 00000013 00000001 win32k!GreAddFontResourceWInternal+0xab
b23a6d44 8053d6f8 0009a560 00000013 00000001 win32k!NtGdiAddFontResourceW+0x172
b23a6d44 7c90e514 0009a560 00000013 00000001 nt!KiFastCallEntry+0xf8
WARNING: Stack unwind information not available. Following frames may be wrong.
0006f90c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd ntdll!KiFastSystemCallRet
0006f910 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f914 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f918 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f91c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f920 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f924 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f928 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f92c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f930 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f934 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f938 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f93c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f940 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f944 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f948 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f94c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f950 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f954 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f958 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f95c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f960 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f964 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f968 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f96c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f970 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f974 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f978 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f97c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f980 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f984 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f988 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f98c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f990 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f994 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f998 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f99c cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9a0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9a4 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9a8 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9ac cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9b0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9b4 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9b8 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9bc cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9c0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9c4 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9c8 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9cc cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9d0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9d4 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9d8 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9dc cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9e0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9e4 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9e8 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9ec cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9f0 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd
0006f9f4 cdcdcdcd cdcdcdcd cdcdcdcd cdcdcdcd 0xcdcdcdcd


STACK_COMMAND:  kb

FOLLOWUP_IP:
win32k!vGetVerticalGSet+46
bf88ef08 ff37            push    dword ptr [edi]

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  win32k!vGetVerticalGSet+46

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  0x50_win32k!vGetVerticalGSet+46

BUCKET_ID:  0x50_win32k!vGetVerticalGSet+46

Followup: MachineOwner
---------