Exploit Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (2)

[Exploiter]

EDB-ID

38265

Проверка EDB

1. Пройдено

Автор

NILS SOMMER

Тип уязвимости

DOS

Платформа

WINDOWS_X86

CVE

cve-2015-1722

Дата публикации

2015-09-22

Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (2)

Source: https://code.google.com/p/google-security-research/issues/detail?id=311

Bitmap object Use-after-Free #2

The attached PoC triggers a blue screen due to a use after free vulnerability. The crashes are unreliable, however you can use Special Pool in order to get reliable crashes. The crashes indicate that it is possible to write to arbitrary addresses.

---
please find the PoC and brief analysis for the issue attached. The analysis mentions how Special Pool can be used to get very reliable crashes, it should crash without Special Pool after a while as well. 
--

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38265.zip