Search...

Windows Kernel - Bitmap Handling Use-After-Free MS15-061

2015-09-22T00:00:00
ID EDB-ID:38275
Type exploitdb
Reporter Nils Sommer
Modified 2015-09-22T00:00:00

Description

Windows Kernel - Bitmap Handling Use-After-Free (MS15-061). CVE-2015-1722. Dos exploit for win32 platform

                                        
                                            Source: https://code.google.com/p/google-security-research/issues/detail?id=293

Platform: Win7 32-bit.
trigger.cpp should fire the issue, with two caveats:
- PoC will NOT work if compiled as a debug build.
- PoC will trigger the condition every time but the subsequent corruption might not cause a crash every time. It may be necessary to run the PoC multiple times.

debug.txt is a sample crash log.

Analysis from Nils:

---
Using the series of calls we are able to free the bitmap object, a reference to this object still exists in the trigger process after killing the first notepad process.

At this time we are able to replace the freed object in memory. We are not able to reuse this object through the original handle, however another free is triggered when quitting the trigger process, which will decrement the reference counter on the freed or replaced object, either modifying heap metadata or freeing the object which was allocated in the place of the original bitmap object.
---

Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/38275.zip
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by