New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.
Issue 295
Starred by 2 users
Status: Fixed
Owner:
█ cevans@google.com
Email to this user bounced
Closed: Jun 2015
Cc:
█ nils.som...@gmail.com
project-...@google.com



Sign in to add a comment
 Windows kernel: use-after-free in WindowStation
Reported by cevans@google.com, Mar 23 2015 Back to list 
Credit is to "Nils Sommer of bytegeist, working with Google Project Zero".

Platform: Win7 32-bit.
trigger.cpp should fire the issue, with caveats:
- PoC MUST be compiled in release mode.
- PoC may need to be run a few times to trigger the crash.

Analysis is attached as a text file.
trigger.cpp
719 bytes Download
debug_analysis.txt
4.3 KB View Download
Comment 1 by cevans@google.com, Mar 23 2015
Labels: Id-21798
Comment 2 by cevans@google.com, Mar 26 2015 
Attaching better PoC.
bug295.cpp
1.0 KB Download
Comment 3 by cevans@google.com, Mar 26 2015
Labels: -Reported-2015-Mar-23 Reported-2015-Mar-26
Comment 4 by cevans@google.com, Jun 4 2015
Labels: CVE-2015-1723
Project Member Comment 6 by hawkes@google.com, Sep 21 2015
Labels: -Restrict-View-Commit
► Sign in to add a comment