New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.
Issue 131
Starred by 4 users
Status: Fixed
Owner:
█ cevans@google.com
Email to this user bounced
Closed: Nov 2014
Cc:
project-...@google.com



Sign in to add a comment
 Flash write crash at NULL + 0x2b288 (on 64-bit)
Reported by cevans@google.com, Oct 21 2014 Back to list 
A PoC is attached. This is a fuzz test case so it's not immediately obvious what is going on, but it is a reliable and consistent test case on Pepper Flash Chrome (Linux x64 confirmed).

When the crash triggers, this is the instruction:

movb   $0x1,0x2b288(%rax)

At the time of the crash %rax == 0.

However, it's possible to get the address 0x2b288 mapped in modern operating systems, because "NULL mapping" protections typically only cover the first 64kb (Windows, Linux) or not at all (Mac OS X 32-bit).

It's unlikely that malicious actionscript will be able to map anything so low on 64-bit, but 32-bit will be an issue.


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
null0x2b288.swf
2.8 MB Download
Project Member Comment 1 by ianbeer@google.com, Oct 21 2014 
Small correction regarding NULL mapping protections on OS X: the default linker options on OS X will insert a 1 page __PAGEZERO section with a fixed mapping at 0 and --- protection, so userspace dereferences of any pointer to addresses on the NULL page aren't exploitable. 0x2b288 falls well outside that and it would be application specific if it were exploitable or not.

32 bit OS X processes allow native code to change the protection of that NULL page mapping at runtime and therefore exploit *kernel* NULL pointer dereferences - this is the fundamental difference to say linux where you need to be root to lower mmap_min_addr and exploit a kernel NULL pointer dereference.
Comment 2 by cevans@google.com, Nov 8 2014
Labels: CVE-2014-0573
Comment 3 by cevans@google.com, Nov 20 2014
Labels: -Restrict-View-Commit Fixed-2014-Nov-11
Status: Fixed
http://helpx.adobe.com/security/products/flash-player/apsb14-24.html
► Sign in to add a comment