New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.
Starred by 2 users
Status: Fixed
Owner:
Email to this user bounced
Closed: May 2015
Cc:



Sign in to add a comment
Flash: info leak due to uninitialized registers when executing Shaders
Reported by cevans@google.com, Apr 8 2015 Back to list
It would appear that when executing a Shader, Flash starts with an uninitialized register state. Therefore, if a Shader program fails to load a texture or constant or other value into the output register, it is possible to leak memory content.

The attached SWF demonstrates this; it may be neccessary to reload the SWF multiple times before you get lucky and leak some non-zero memory content. An image is attached as an example of what it can look like when the leak triggers (Linux x64).


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 
ShaderRegisters.swf
1001 bytes Download
leak2.png
1.4 KB View Download
ShaderRegisters.as
1.3 KB Download
Comment 1 by cevans@google.com, Apr 10 2015
Labels: Id-3569
Comment 2 by cevans@google.com, May 7 2015
Labels: CVE-2015-3092
Comment 3 by cevans@google.com, May 12 2015
Labels: Fixed-2015-May-12
Status: Fixed
https://helpx.adobe.com/security/products/flash-player/apsb15-09.html
Comment 4 by cevans@google.com, Jun 26 2015
Labels: -Restrict-View-Commit
Sign in to add a comment