New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.
Issue 312
Starred by 2 users
Status: Fixed
Owner:
█ cevans@google.com
Email to this user bounced
Closed: Jun 2015
Cc:
█ nils.som...@gmail.com
project-...@google.com



Sign in to add a comment
 Windows kernel: possible NULL pointer dereference of a SURFOBJ
Reported by cevans@google.com, Mar 31 2015 Back to list 
---
this issue is very likely a null pointer issue affecting 32-bit Windows version. The offset is from add onto another offset which isn't quite zero, so not 100% convinced it is just a null pointer, however I wasn't able to influence the values. because it was very straight forward to get EIP there is a PoC setting EIP to 0xdeadbeef
Debug output attached
---


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
bug312.cpp
3.6 KB Download
bug312_crash.txt
6.1 KB View Download
Comment 1 by cevans@google.com, Mar 31 2015 
Credit is to "Nils Sommer of bytegeist, working with Google Project Zero".
Comment 2 by cevans@google.com, Mar 31 2015
Labels: Id-21828
Comment 3 by cevans@google.com, Jun 4 2015
Labels: CVE-2015-1725
Comment 4 by cevans@google.com, Jun 4 2015 
Same root cause as https://code.google.com/p/google-security-research/issues/detail?id=313, according to Microsoft. CVE shared.
Project Member Comment 6 by hawkes@google.com, Sep 21 2015
Labels: -Restrict-View-Commit
► Sign in to add a comment