See also https://code.google.com/p/google-security-research/issues/detail?id=246

To reproduce, host the attached SWF and other files on a web server (e.g. localhost) and load it like this:

http://localhost/PlayManifest.swf?file=oob_frma.mpd

On Chrome Windows Canary 64-bit, windbg sees the crash like this:

000007fe`ed8fb4c5 ...   mov dword ptr [rax+rsi+1459Ch],eax ds:00000218`01d8f9a4

eax = 0x41414141

As can be seen, the value being written to the out-of-bounds location is under attacker control. The out-of-bounds location appears to be quite wild, perhaps +4GB out-of-bounds. An example of how to exploit such issues, even in the presence of a memory limit, is covered on the Project Zero blog: http://googleprojectzero.blogspot.com/2014/09/exploiting-cve-2014-0556-in-flash.html

On 32-bit, I believe the corruption will be much more subtle, always landing in an allocated chunk, due to address-space wrap around at 4GB. I'd expect the issue to be more reliably exploitable on 32-bit, but even getting a PoC that crashes on 32-bit would be a lot more work.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

oob_frma.mp4 20 bytes Download

PlayManifest.as 1.8 KB Download

PlayManifest.swf 7.4 KB Download

oob_frma.mpd 626 bytes Download