3 ms·
This is standard description of a UAF (use-after-free) flaw. Reliability can vary from "30% of the time, it works every time" to perfectly reliable. It just de
by xyzzy123 11y ago
This is standard description of a UAF (use-after-free) flaw. Reliability can vary from "30% of the time, it works every time" to perfectly reliable. It just depends on the instance of the bug. It is one of the most common exploitable bug classes found via fuzzing.
Because so many browser fuzzing crashes are UAFs, people have put a lot of effort into developing reliable techniques for exploiting them.
See e.g: http://www.rapid7.com/db/modules/exploit/windows/browser/ms14_012_cmarkup_uaf http://www.rapid7.com/db/modules/exploit/windows/browser/ms1... for a reasonably reliable example.
- sago 11y agoThank you, exactly what I needed to understand.
- ssclafani 11y agoGoogle's Project Zero team has written some good blog posts on this topic if you want to read more: http://googleprojectzero.blogspot.com/2015/06/what-is-good-memory-corruption.html http://googleprojectzero.blogspot.com/2015/06/what-is-good-m... http://googleprojectzero.blogspot.com/2015/06/dude-wheres-my-heap.html http://googleprojectzero.blogspot.com/2015/06/dude-wheres-my...