505 - Windows kernel use-after-free with device contexts and NtGdiSelectBitmap - project-zero

Starred by 1 user

Status:	Fixed
Owner:	hawkes@google.com
Closed:	Nov 2015
Cc:	█ nils.som...@gmail.com project-...@google.com
Finder-nils MSRC-30922 Deadline-90 Product-Windows Reported-2015-Aug-17 CCProjectZeroMembers Severity-High CVE-2015-6100 Vendor-Microsoft

Windows kernel use-after-free with device contexts and NtGdiSelectBitmap

Project Member Reported by hawkes@google.com, Aug 17 2015

Back to list

Credit is to "Nils Sommer of bytegeist, working with Google Project Zero".

---
The attached testcase triggers a use-after-free condition in win32k. The attached debugger output was triggered on Windows 7 with Special Pool enabled on win32k.sys. 
---

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

poc.cpp
1.7 KB Download

debugger.txt
56.7 KB View Download

Project Member Comment 1 by hawkes@google.com, Oct 7 2015

Labels: MSRC-30922

Project Member Comment 2 by hawkes@google.com, Nov 20 2015

Labels: -Restrict-View-Commit CVE-2015-6100
Status: Fixed

Fixed in MS15-115

► Sign in to add a comment