New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.
Issue 458
Starred by 2 users
Status: Fixed
Owner:
hawkes@google.com
Closed: Sep 2015
Cc:
█ nils.som...@gmail.com
project-...@google.com



Sign in to add a comment
 Windows kernel: use-after-free in bGetRealizedBrush
Reported by cevans@google.com, Jun 22 2015 Back to list 
Credit is to "Nils Sommer of bytegeist, working with Google Project Zero".

I confirm a blue screen on Win 7 32-bit with special pool enabled.

---
The attached testcase crashes Win 7 with Special Pool on win32k while accessing freed memory in bGetRealizedBrush​​.
---

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
special_pool458.txt
6.4 KB View Download
bug458.cpp
2.2 KB Download
Comment 1 by cevans@google.com, Jun 22 2015
Labels: Id-30497
MSRC Case 30497 TRK:0001803
Project Member Comment 2 by hawkes@google.com, Aug 21 2015
Owner: hawkes@google.com
Project Member Comment 3 by hawkes@google.com, Sep 10 2015
Labels: CVE-2015-2518
Status: Fixed
Project Member Comment 4 by hawkes@google.com, Sep 21 2015
Labels: -Restrict-View-Commit
Fixed in September bulletin MS15-097.
► Sign in to add a comment