Attacking ECMAScript Engines with Redefinition
Summary: Project Zero's Natalie Silvanovich documented 24 ECMAScript redefinition vulnerabilities found in Adobe Flash over a few months, where native code assumes a function or variable behaves a certain way but the language allows it to be redefined. The post walks through specific cases including CVE-2015-3077 and CVE-2015-0305 (type confusion via the equality operator), CVE-2015-0327 (a Proxy object overflow), CVE-2015-3039 and CVE-2015-5119 (use-after-free via conversion operators), and CVE-2015-3120 and CVE-2015-3119 (type confusion via watches).
Key Takeaway: Four of the five Adobe Flash vulnerabilities in the HackingTeam leak involved redefinition, including CVE-2015-5119, which frees and reallocates a ByteArray buffer before a write lands on the original buffer. The bug class lives wherever native code trusts a dynamically redefinable function, so the reachability problem is the defender's problem too.
Read the original at Google Project Zero ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2013-0765CVE-2014-1705CVE-2015-0349CVE-2015-3077CVE-2015-5119CVE-2015-5122CVE-2015-5123
- Related
- CVE-2015-5122: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022CVE-2015-5123: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022CVE-2015-5119: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022