MacOS Kernel < 10.12.2 / iOS < 10.2 - _kernelrpc_mach_port_insert_right_trap Reference Count L

Exploit for multiple platform in category local exploits / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=941 Proofs of Concept: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40956.zip The previous ref count overflow bugs were all kinda...

PHP garbage collection mechanism UAF vulnerability analysis-vulnerability warning-the black bar safety net

First, the PHP garbage collection mechanism introduction Because PHP is among the presence of circular references, only the refcount of the counter as a garbage collection mechanism is not enough, so in PHP5. 3 introduced a new garbage collection mechanism. $a = array'one'; $a = &$a; unset$a; ?&...

Overflow using FILE structure-vulnerability warning-the black bar safety net

Recently, the Shanghai University student network security game it only shows a title pwn450, for not a lot of me, and instantly rip off forced, but the gangster or gangster, and finally was quite what the Yankees do come up, but anyway I didn't make out, and finally see explanations, with two...

Apple OS XiOS - mach_ports_register Multiple Memory Safety s

Apple OS XiOS - machportsregister Multiple Memory Safety s Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=882 machportsregister is a kernel task port MIG method. It's defined in MIG like this: routine machportsregister targettask : taskt; initportset : machportarrayt = ^array o...

Apple OS X Kernel - IOBluetoothFamily.kext Use-After-Free

Apple OS X Kernel - IOBluetoothFamily.kext Use-After-Free / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=830 When you create a new IOKit user client from userspace you call: kernreturnt IOServiceOpen ioservicet service, taskportt owningTask, uint32t type, ioconnectt connect ;...

IE browser exploits technology evolution(II)-vulnerability warning-the black bar safety net

Foreword In a previous article, we talked about some of the early ie related exploits, from the most basic, the most simple stack overflow vulnerability of the use of speaking, to the relatively more complex UAF exploits. Through these exploits evolution, as if we can see the human society from t...

WebKit not_number defineProperties UAF

This module exploits a UAF vulnerability in WebKit's JavaScriptCore library. Module Options msf use exploit/apple/ios/browser/webkittrident msf undefinedwebkittrident show actions ...actions... msf undefinedwebkittrident set ACTION msf undefinedwebkittrident show options ...show and set options...

UAF vulnerability description-vulnerability warning-the black bar safety net

UAF Use After Freevulnerability is a memory corruption vulnerability,usually present in the browser. Recently,the browser's new version Added a series of controls,which also makes use of these vulnerabilities becomes more difficult. Nevertheless,they still seem to exist. This article mainly will ...

Adobe Flash - JXR Processing Double-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=788 There is a heap overflow when loading the attacked JXR file in Adobe Flash. To reproduce, load the attached file using LoadImage.swf?img=12.atf. This issue can be a bit difficult to reproduce, as the crash occurs when the playe...

Adobe Flash - JXR Processing Double-Free

Adobe Flash - JXR Processing Double-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=788 There is a heap overflow when loading the attacked JXR file in Adobe Flash. To reproduce, load the attached file using LoadImage.swf?img=12.atf. This issue can be a bit difficult to...

Apple Mac OSX / iOS - Kernel UAF Racing getProperty on IOHDIXController and testNetBootMethod on IOH

Exploit for macOS platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=732 This is perhaps a more interesting UaF than just racing testNetBootMethod calls as there looks to be a path to getting free'd memory disclosed back to userspace. Although the...

Apple Mac OSX / iOS Kernel - UAF Racing getProperty on IOHDIXController and testNetBootMethod on IOHDIXControllerUserClient

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=732 This is perhaps a more interesting UaF than just racing testNetBootMethod calls as there looks to be a path to getting free'd memory disclosed back to userspace. Although the copyProperty macro used by...

Apple Mac OSX iOS Kernel - UAF Racing getProperty on IOHDIXController and testNetBootMethod on IOHDIXControllerUserClient

Apple Mac OSX iOS Kernel - UAF Racing getProperty on IOHDIXController and testNetBootMethod on IOHDIXControllerUserClient / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=732 This is perhaps a more interesting UaF than just racing testNetBootMethod calls as there looks to be a...

Linux内核 Keyrings 引用计数溢出 UAF 漏洞

漏洞分析 Linux Kernel的这个漏洞会造成两个影响，第一个是造成信息泄露，可以bypass ASLR，另一个是UAF造成代码执行，利用的是KeyRing机制中的两个漏洞，一个是对Keyring操作控制不严谨，另一个是利用对Keyring计数变量控制不严谨，其中代码执行利用条件相对苛刻，下面对此漏洞进行详细分析。 Keyring信息泄露： Keyring和安全密钥有关，进程可以申请自己新的keyring，同时也可以通过申请新的keyring替换老的keyring，其中，调用到joinsessionkeyring函数。 long joinsessionkeyringconst cha...

Internet Bug Bounty: Adobe Flash Player Regular Expression UAF Remote Code Execution Vulnerability

I. Summary There's a UAF Vulnerability in the PCRE engine version used in Flash that could lead to Remote Code Execution. II. Affected Adobe Flash Player 11.5.502.135 20.0.0.286 III. Reference Identified as CVE-2016-4121, and reported to Adobe directly...

Windows kernel Vulnerability CVE-2 0 1 6-0 1 4 3 analysis-vulnerability warning-the black bar safety net

4 on 2 0 March, Nils Sommer in the exploitdb on broke a new Windows kernel vulnerability PoC. The vulnerability affects all versions of Windows operating system, the attacker after the success of available privilege escalation, Microsoft in 4, on patch day fixes the vulnerability. 0×0 1...

Foxit Reader 7.3.0 UAF 漏洞

No description provided by source...

Microsoft Internet Explorer: UAF in MSHTML!CSVGHelpers::SetAttributeStringAndPointer

No description provided by source...

Microsoft Internet Explorer CButton 对象 UAF漏洞 任意代码执行漏洞

No description provided by source...

Adobe Flash - Uninitialized Stack Parameter Access in AsBroadcaster.broadcastMessage UaF Fix

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=717 The ActionScript parameter conversion in the fix for an issue in the December Flash bulletin https://helpx.adobe.com/security/products/flash-player/apsb15-32.html, most likely...