New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 692327 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 676773
Owner:
Last visit > 30 days ago
Closed: Mar 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security: Adobe Flash Player Use After Free Vulnerability Valentine Series (3)

Reported by xiong12...@gmail.com, Feb 15 2017

Issue description

VERSION
Chrome Version: 57.0.2987.21 beta (64-bit), pepflashplayer 24.0.0.221
Operating System: Windows 7 en 64-bit

REPRODUCTION CASE

Open the poc in the attachment with chrome and observe the crash.
There is also a detailed write-up about the vulnerability in the attachment.


FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: tab
Crash State: 

5:078> g
(c64.1144): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
pepflashplayer!PPP_ShutdownBroker+0x21704e:
000007fe`de7db84e 498b88c0000000  mov     rcx,qword ptr [r8+0C0h] ds:00000000`800000b0=????????????????
8:123> k
Child-SP          RetAddr           Call Site
00000000`001adc70 000007fe`de7db9f2 pepflashplayer!PPP_ShutdownBroker+0x21704e
00000000`001adcd0 000007fe`de9aadc8 pepflashplayer!PPP_ShutdownBroker+0x2171f2
00000000`001add20 000007fe`de9b2c0d pepflashplayer!PPP_ShutdownBroker+0x3e65c8
00000000`001add80 000007fe`de7ada8a pepflashplayer!PPP_ShutdownBroker+0x3ee40d
00000000`001ae530 000007fe`de7aeade pepflashplayer!PPP_ShutdownBroker+0x1e928a
00000000`001ae590 000007fe`de7f7339 pepflashplayer!PPP_ShutdownBroker+0x1ea2de
00000000`001ae850 000007fe`de7f72e6 pepflashplayer!PPP_ShutdownBroker+0x232b39
00000000`001ae880 000007fe`de7bd111 pepflashplayer!PPP_ShutdownBroker+0x232ae6
00000000`001ae8d0 000007fe`de5db75d pepflashplayer!PPP_ShutdownBroker+0x1f8911
00000000`001ae960 000007fe`de60127b pepflashplayer!PPP_ShutdownBroker+0x16f5d
00000000`001aeb70 000007fe`de60118e pepflashplayer!PPP_ShutdownBroker+0x3ca7b
00000000`001aebc0 000007fe`de60163c pepflashplayer!PPP_ShutdownBroker+0x3c98e
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.21\chrome_child.dll - 
00000000`001aebf0 000007fe`e1c32574 pepflashplayer!PPP_ShutdownBroker+0x3ce3c
00000000`001aec20 000007fe`e1c780d5 chrome_child!IsSandboxedProcess+0x216f4
00000000`001aec50 000007fe`e1c4cf8a chrome_child!IsSandboxedProcess+0x67255
00000000`001aecc0 000007fe`e1c4cabc chrome_child!IsSandboxedProcess+0x3c10a
00000000`001aecf0 000007fe`e1c4cc06 chrome_child!IsSandboxedProcess+0x3bc3c
00000000`001aed60 000007fe`e1c1df96 chrome_child!IsSandboxedProcess+0x3bd86
00000000`001aeed0 000007fe`e05d23fe chrome_child!IsSandboxedProcess+0xd116
00000000`001aef00 000007fe`e058718c chrome_child!ovly_debug_event+0xc9fce


Credit:

Yuki Chen Of Qihoo 360 Vulcan Team
 

Comment 1 Deleted

Comment 2 by och...@chromium.org, Feb 15 2017

Components: Internals>Plugins>Flash
Owner: natashenka@google.com
Status: ExternalDependency (was: Unconfirmed)
Natalie, would you mind helping with these?
Thanks, I've reported this.
This is PSIRT-6414
Mergedinto: 676773
Status: Duplicate (was: ExternalDependency)
Adobe says this is the same as 676773.
Project Member

Comment 6 by sheriffbot@chromium.org, Feb 16 2018

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment