9 ms·
Sounds like a use After free vulnerability. IE Is well known for these [1]. If you know C or C++ it's very straight forward. A function creates an object or st
by Moral_ 13y ago
Sounds like a use After free vulnerability. IE Is well known for these [1].
If you know C or C++ it's very straight forward. A function creates an object or structure on the heap. The malicious code writer or the function can then pass a pointer to that object/struct to another function which then frees it. The problem is the other function doesn't realize that the pointer has been freed and is still able to write into that memory address even though it's sitting on the free list.
The interesting arises when another object gets allocated to the same location. Since you still have a dangling pointer, you can write into that object. If it's C++ you can overwrite the virtual function table pointer to one you control, or if its C hope that there is a function pointer hanging around.
[1] http://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-9900/Microsoft-Internet-Explorer.html http://www.cvedetails.com/vulnerability-list/vendor_id-26/pr...
- cwzwarich 13y agoPretty much all web browser engines are full of use-after-free issues, not just IE.
- pjmlp 13y agoCorrection, most applications coded in languages with manual memory management (C, C++, Pascal dialects), without use of static code analysers to verify correctness.
- mpyne 13y agoC++ has automatic memory management, but it also supports manual as an option and for some reason people keep using it. Of course it appears Rust will be much better in this regard.
- pjmlp 13y agoIt is amazing how many companies forbid the use of STL, templates and all related mechanisms that enable automatic memory management in C++ in their style guides, while still coding in C style.
- pcwalton 13y agoGoogle uses the STL everywhere in Chrome.
- pjmlp 13y agoSure, but Google is special. We are talking about normal companies in regard what features one is allowed to use. If you mean security and STL. Do Google developers use std::array::at() instead of std::array::operator[]() as an example? Do they use smart pointers and STL containers instead of pure C++ pointers, arrays, strings everywhere? Do they use references instead of pointers in function arguments for out parameters? Do they use RAII for all types of resources? Do they produce builds with -Wall -Werror? Does the static analyzer run as part of the build? Being able to use STL is just the first step for secure C++.
- beagle3 13y ago> enable automatic memory management enable OPTIONAL automatic memory management. The problem is it does not enforce it. I've never heard of a place that forbade STL, templates or such since 2005 or so. But it's not like STL or templates help; It's RAII that does. And there's no way to enforce RAII, so a stl::list<char * > is not any better at protecting you from use after free than char * x[] is.
- pjmlp 13y agoStatic analysis, although it only fixes your own code, not third party libraries.
- pcwalton 13y ago> C++ has automatic memory management, but it also supports manual as an option and for some reason people keep using it. Automatic memory management in C++ does not effectively protect you from use-after-free.