4 ms·
I don't think you can count use-after-free as exploitable. Sure, if you have them (and I think those cases can largely be ruled out by good design), it leads to
by jstimpfle 11y ago
I don't think you can count use-after-free as exploitable. Sure, if you have them (and I think those cases can largely be ruled out by good design), it leads to crashes. But for memory type exploits you need control over the value in it. Not a security specialist but I'm not aware of common attacks besides overflowing buffers.
In hot paths (like codecs, compression algorithms...) I'm sure you never want bounds checking. It can be optimized away for sequential loops of course, but not so easily in the case of data lookups.
- steveklabnik 11y agohttps://www.owasp.org/index.php/Using_freed_memory https://www.owasp.org/index.php/Using_freed_memory
- jstimpfle 11y ago"While it is technically feasible for the freed memory to be re-allocated and for an attacker to use this reallocation to launch a buffer overflow attack, we are unaware of any exploits based on this type of attack."
- comex 11y agoI have no idea what that article is talking about. Use-after-free exploits have been extremely common for years. Like I said, look at Pwn2Own (which requires submitting an actual working exploit): https://www.google.com/search?q=pwn2own+use-after-free https://www.google.com/search?q=pwn2own+use-after-free
- pcwalton 11y agoIt's so common there's a tutorial on it: http://www.fuzzysecurity.com/tutorials/expDev/11.html http://www.fuzzysecurity.com/tutorials/expDev/11.html
- jstimpfle 11y agoThanks!
- steveklabnik 11y agoGah, it seems this one isn't good. I trust OWASP and skimmed, it seems that I agree with sibling commentors that this is more dangerous than is presented here.
- pcwalton 11y agoUse after free is a really common form of RCE. Have you heard the term "heap spray"? That's an exploitation technique for use after free.