Version: VMware Workstation 11.1
Host Platform: Windows 8.1 amd64

Summary:
Printer virtualization under VMware Workstation involves a vprintproxy.exe process launched by vmware-vmx.exe on the Host. It will receive and process EMFSPOOL files sent by a Guest on its COM1 port, if a virtual printer has been added to the VM hardware (default). Several vulnerabilities in this component allow an unprivileged Guest user to execute code on the Host.

Description:
When extracting a TrueType font from the EMFSPOOL file, TPView.dll will verify the checksum of the font prior to further processing. To do so, it will walk the tables, zero out the padding at the end of a table and checksum the table. In doing so, it will trust the 'offset' field of the table record and add it to a pointer to the font buffer. While there is a check to make sure that we don’t go past the end of the font, nothing prevents us from referencing and zeroing memory prior to the font, as the 32-bit arithmetic will wrap.

.text:10009069 8B 75 10                          mov     esi, [ebp+arg_8]
.text:1000906C 33 DB                             xor     ebx, ebx
.text:1000906E 33 C9                             xor     ecx, ecx
.text:10009070 33 D2                             xor     edx, edx
.text:10009072 8B 46 08                          mov     eax, [esi+8]
.text:10009075 8A 5E 09                          mov     bl, [esi+9]
.text:10009078 8A 7E 08                          mov     bh, [esi+8]
.text:1000907B 57                                push    edi
.text:1000907C C1 E8 10                          shr     eax, 10h
.text:1000907F 8A CC                             mov     cl, ah
.text:10009081 8B 7D 08                          mov     edi, [ebp+arg_0]
.text:10009084 C1 E3 10                          shl     ebx, 10h
.text:10009087 8A E8                             mov     ch, al
.text:10009089 8B 46 0C                          mov     eax, [esi+0Ch]
.text:1000908C 0B D9                             or      ebx, ecx
.text:1000908E 33 C9                             xor     ecx, ecx
.text:10009090 8A 4E 0D                          mov     cl, [esi+0Dh]
.text:10009093 03 DF                             add     ebx, edi       ; base+offset
.text:10009095 8A 6E 0C                          mov     ch, [esi+0Ch]
.text:10009098 C1 E8 10                          shr     eax, 10h
.text:1000909B 8A D4                             mov     dl, ah
.text:1000909D 8A F0                             mov     dh, al
.text:1000909F 8B 45 0C                          mov     eax, [ebp+arg_4]
.text:100090A2 C1 E1 10                          shl     ecx, 10h
.text:100090A5 0B CA                             or      ecx, edx
.text:100090A7 03 F8                             add     edi, eax       ; base+totalsize
.text:100090A9 03 CB                             add     ecx, ebx       ; base+offset+length
.text:100090AB 57                                push    edi
.text:100090AC 53                                push    ebx
.text:100090AD 89 4D 10                          mov     [ebp+arg_8], ecx
.text:100090B0 E8 60 FE FF FF                    call    kk_IsArg0LowerThanArg4 ; base+offset<base+totalsize?
.text:100090B5 59                                pop     ecx
.text:100090B6 84 C0                             test    al, al
.text:100090B8 59                                pop     ecx
.text:100090B9 74 0F                             jz      short loc_100090CA
.text:100090BB 57                                push    edi
.text:100090BC FF 75 10                          push    [ebp+arg_8]
.text:100090BF E8 51 FE FF FF                    call    kk_IsArg0LowerThanArg4 ; base+offset+length<base+totalsize?
.text:100090C4 59                                pop     ecx
.text:100090C5 84 C0                             test    al, al
.text:100090C7 59                                pop     ecx
.text:100090C8 75 04                             jnz     short loc_100090CE
.text:100090CA
.text:100090CA                   loc_100090CA:                           ; CODE XREF: kk_NonHeadChecksum+55j
.text:100090CA 32 C0                             xor     al, al
.text:100090CC EB 52                             jmp     short loc_10009120
.text:100090CE                   ; ---------------------------------------------------------------------------
.text:100090CE
.text:100090CE                   loc_100090CE:                           ; CODE XREF: kk_NonHeadChecksum+64j
.text:100090CE 8B 46 0C                          mov     eax, [esi+0Ch]
.text:100090D1 33 C9                             xor     ecx, ecx
.text:100090D3 8A 4E 0D                          mov     cl, [esi+0Dh]
.text:100090D6 33 D2                             xor     edx, edx
.text:100090D8 8A 6E 0C                          mov     ch, [esi+0Ch]
.text:100090DB C1 E8 10                          shr     eax, 10h
.text:100090DE 8A D4                             mov     dl, ah
.text:100090E0 0F B6 D2                          movzx   edx, dl
.text:100090E3 C1 E1 10                          shl     ecx, 10h
.text:100090E6 0B CA                             or      ecx, edx
.text:100090E8 33 D2                             xor     edx, edx
.text:100090EA 8A F0                             mov     dh, al
.text:100090EC 0F B7 C2                          movzx   eax, dx
.text:100090EF 0B C8                             or      ecx, eax
.text:100090F1 51                                push    ecx             ; length
.text:100090F2 53                                push    ebx             ; base+offset
.text:100090F3 E8 39 FE FF FF                    call    kk_MemsetAndChecksum

Both checks can be bypassed with a "negative" offset, allowing to zero a portion of memory located prior to the font. This will be 1 to 3 bytes based on the length of the table entry, corresponding to the padding.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.