Microsoft Windows Kernel - Brush Object Use-After-Free (MS15-061)
🗓️ 22 Sep 2015 00:00:00Reported by Google Security ResearchType 
exploitdb🔗 www.exploit-db.com👁 40 Views
| Reporter | Title | Published | Views | Family All 13 |
|---|---|---|---|---|
 | Windows Privilege Escalation | 20 Jan 201600:00 | – | bdu_fstec |
 | CVE-2015-1724 | 22 Sep 201500:00 | – | circl |
 | Microsoft Windows Kernel Object Memory Misreference Vulnerability | 10 Jun 201500:00 | – | cnvd |
 | CVE-2015-1724 | 10 Jun 201501:00 | – | cve |
 | CVE-2015-1724 | 10 Jun 201501:00 | – | cvelist |
 | KLA10599 Multiple vulnerabilities in Microsoft Products | 9 Jun 201500:00 | – | kaspersky |
 | CVE-2015-1724 | 10 Jun 201501:59 | – | nvd |
 | Microsoft Windows Kernel-Mode Driver Privilege Elevation Vulnerabilities (3057839) | 10 Jun 201500:00 | – | openvas |
 | Design/Logic Flaw | 10 Jun 201501:59 | – | prion |
 | PT-2015-1307 | 9 Jun 201500:00 | – | ptsecurity |
10
Source: https://code.google.com/p/google-security-research/issues/detail?id=304
Creating a device context with the flag (DCX_NORESETATTRS) and selecting a brush object into the device context will result in the brush being freed on process exit without the reference to the object being cleared. The PoC consists of two files (prime304.cpp and poc304.cpp). poc304 will execute prime304, which triggers the issue and allows poc304 to retrieve a handle to the device context with the pointer to the freed object. We can confirm this by requesting the handle for the brush object from the device context, resulting in reading freed memory. In some cases the issue leads to memory corruption when for example another object is allocated into the space of the free brush object (see attached crash logs for examples).
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38272.zipData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Sep 2015 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 27.2
EPSS0.03311