New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.
Issue 746
Starred by 1 user
Status: Fixed
Owner:
hawkes@google.com
Closed: Jun 2016
Cc:
█ nils.som...@gmail.com
project-...@google.com



Sign in to add a comment
 Windows 7 win32k bitmap use-after-free (#1)
Project Member Reported by hawkes@google.com, Feb 26 2016 Back to list 
Credit is to "Nils Sommer of bytegeist, working with Google Project Zero".

---
The attached PoC triggers a blue screen on Windows 7 with special pool enabled on win32k.sys . A reference to the bitmap object still exists in the device context after it has been deleted.
---

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
poc_p3_04.cpp
1.7 KB Download
special_pool.txt
6.5 KB View Download
Project Member Comment 1 by hawkes@google.com, Feb 26 2016
Labels: MSRC-32664
Project Member Comment 2 by hawkes@google.com, Mar 15 2016
Cc: nils.som...@gmail.com
Project Member Comment 3 by mjurczyk@google.com, Jun 15 2016
Labels: -Restrict-View-Commit -Reported-2015-Feb-26 Fixed-2016-May-10 CVE-2016-0171 Reported-2016-Feb-26
Status: Fixed
Fixed in https://technet.microsoft.com/library/security/MS16-062.
► Sign in to add a comment