New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.
Issue 686
Starred by 1 user
Status: Fixed
Owner:
hawkes@google.com
Closed: Mar 2016
Cc:
█ nils.som...@gmail.com
project-...@google.com



Sign in to add a comment
 Windows kernel: bitmap use-after-free
Project Member Reported by hawkes@google.com, Dec 28 2015 Back to list 
Credit is to "Nils Sommer of bytegeist, working with Google Project Zero".

---
​The attached Proof-of-Concept crashes Windows 7 with special pool enabled on win32k.sys. The crashes are triggering in multiple different ways (two examples attached).
---

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
poc.cpp
1.4 KB Download
special_pool2.txt
5.0 KB View Download
special_pool1.txt
5.0 KB View Download
Project Member Comment 1 by hawkes@google.com, Dec 28 2015
Cc: nils.som...@gmail.com
Project Member Comment 2 by hawkes@google.com, Mar 31 2016
Labels: -Restrict-View-Commit CVE-2016-0094
Status: Fixed
► Sign in to add a comment