Is It the Beginning of the End For Use-After-Free Exploitation?
Summary: Unit 42 reports that Microsoft patched 122 Internet Explorer vulnerabilities in the prior year, most of them use-after-free bugs, and 126 more to date this year, with 4 of those actively exploited in the wild (CVE-2014-1815, CVE-2014-1776, CVE-2014-0322, CVE-2014-0324), all use-after-free based. In response Microsoft added an isolated heap in June and a deferred free mechanism called ProtectedFree in July that fills freed blocks with 0x00 data and holds them in a pool until it reaches a 100k (0x186A0) threshold before performing the real free.
Why it matters: Unit 42's proof-of-concept JavaScript shows the threshold can be forced: by growing the st_ProtecFreeManageHeap structure past 0x186A0 bytes, an attacker can trigger a true free and reclaim the object, so the mitigation raises cost rather than closing the class. The same deferred free also breaks page heap debugging, leaving researchers unable to confirm a use-after-free has occurred.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2014-0322CVE-2014-0324CVE-2014-1776CVE-2014-1815
- Related
- Addressing CVE-2014-6332 SWF Exploit Cyber Risks ·