Microsoft Windows Kernel – Bitmap Handling Use-After-Free (MS15-061) (2)

Exploit Database
106 阅读

作者： Nils Sommer

日期： 2015-09-22
类别：
- dos
平台：
- windows_x86
来源：https://www.exploit-db.com/exploits/38265/

Source: https://code.google.com/p/google-security-research/issues/detail?id=311

Bitmap object Use-after-Free #2

The attached PoC triggers a blue screen due to a use after free vulnerability. The crashes are unreliable, however you can use Special Pool in order to get reliable crashes. The crashes indicate that it is possible to write to arbitrary addresses.

---

please find the PoC and brief analysis for the issue attached. The analysis mentions how Special Pool can be used to get very reliable crashes, it should crash without Special Pool after a while as well.

Proof of Concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38265.zip

last Exploits
Microsoft Windows Kernel – Bitmap Handling Use-After-Free (MS15-061) (2)的更多信息

PHP 5.4SVN-2012-02-03 – htmlspecialchars/entities Buffer Overflow：
Apple Mac OSX 10.10 – IOKit IntelAccelerator Null Pointer Dereference：
Mozilla Firefox 3.6.4 – ‘Plugin’ EnsureCachedAttrParamArrays Remote Code Execution：
SapLPD 7.40 – Denial of Service：
Microtik SSH Daemon 6.44.3 – Denial of Service (PoC)：
Adobe Acrobat Reader DC – Heap-Based Memory Corruption due to Malformed TTF Font：
eSignal and eSignal Pro 10.6.2425.1208 – Multiple Vulnerabilities：
Microsoft Edge Chakra – ‘JavascriptFunction::ReparseAsmJsModule’ Incorrectly Re-parses：