747 - Windows 7 win32k bitmap use-after-free (#2) - project-zero

Starred by 1 user

Status:	Fixed
Owner:	hawkes@google.com
Closed:	Jun 2016
Cc:	█ nils.som...@gmail.com project-...@google.com
Finder-nils Reported-2016-Feb-26 Deadline-90 Product-Windows MSRC-32665 CCProjectZeroMembers Severity-High Vendor-Microsoft Fixed-2016-May-10 CVE-2016-0173

Windows 7 win32k bitmap use-after-free (#2)

Project Member Reported by hawkes@google.com, Feb 26 2016

Back to list

Credit is to "Nils Sommer of bytegeist, working with Google Project Zero".

---
The attached PoC crashes 32-bit Windows 7 with special pool enabled on win32k.sys. It might take several runs in order to reproduce. Tested the PoC on a single core VM.
---

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

special_pool.txt
5.7 KB View Download

poc_p3_05.cpp
4.2 KB Download

Project Member Comment 1 by hawkes@google.com, Feb 26 2016

Labels: MSRC-32665

Project Member Comment 2 by hawkes@google.com, Mar 15 2016

Cc: nils.som...@gmail.com
Labels: -Severity-high Severity-High

Project Member Comment 3 by mjurczyk@google.com, Jun 15 2016

Labels: -Restrict-View-Commit -Reported-2015-Feb-26 Fixed-2016-May-10 CVE-2016-0173 Reported-2016-Feb-26
Status: Fixed

Fixed in https://technet.microsoft.com/library/security/MS16-062.

Comment 4 Deleted

► Sign in to add a comment