VULNERABILITY DETAILS


VERSION
Chrome Version: 52.0.2743.41 beta-m (64-bit)
Operating System: Windows 7 en 64-bit

REPRODUCTION CASE

This is a use after free vulnerability on an inner object of the PSDK object.
When you call the getter property PSDK.pSDK, you can get an instance of PSDK object. And if you do this:

var o1 = PSDK.pSDK;
var o2 = PSDK.pSDK;

o1 and o2 will be different objects, while they share a same inner object. And if you call 

o1.release();

The inner object will be freed while o2 still has a reference to it. This causes the use after free issue. This bug is highly exploitable. I attached a poc to demonstrate eip-control in chrome 64-bit windows. To test this poc, just visit the index.html with chrome.


FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION

Type of crash: Tab (Flash Content Process)

Crash State: 

(15e0.1594): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.41\PepperFlash\pepflashplayer.dll - 
pepflashplayer!PPP_ShutdownBroker+0x6430be:
000007fe`d83e466e ff5018          call    qword ptr [rax+18h] ds:88888888`888888a0=????????????????
0:000> k
Child-SP          RetAddr           Call Site
00000000`001ebc90 000007fe`d8106ffc pepflashplayer!PPP_ShutdownBroker+0x6430be
00000000`001ebdd0 0000048d`cbec5d0c pepflashplayer!PPP_ShutdownBroker+0x365a4c
00000000`001ebe00 00000000`001ebec0 0x48d`cbec5d0c
00000000`001ebe08 000007fe`d7f77890 0x1ebec0
00000000`001ebe10 0000048d`cbed7a5a pepflashplayer!PPP_ShutdownBroker+0x1d62e0
00000000`001ebe40 00000000`00000000 0x48d`cbed7a5a


0:000> lmvm pepflashplayer
start             end                 module name
000007fe`d7da0000 000007fe`d9ca7000   pepflashplayer   (export symbols)       C:\Program Files 
    Image name: pepflashplayer.dll
    Timestamp:        Tue Jun 14 06:26:14 2016 (575F3306)
    CheckSum:         01E1E3D1
    ImageSize:        01F07000
    File version:     22.0.0.192
    Product version:  22.0.0.192
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0