The Power of Pair: One Template that Reveals 100+ UAF IE Vulnerabilities
summary
Claims a single pair template strategy uncovers over 100 Internet Explorer use‑after‑free flaws and leads to dozens of CVEs; implementation is a custom C‑based fuzzer running on 20 VMs with a 1 million rule per idea. The run yields ~8.1 million crash samples, ~400 distinct crash sites, about 150 likely exploitable bugs and 100+ reports sent to Microsoft. Examples are concrete: undo/redo, DOM reparenting, focus/blur and style toggles that reliably trigger UAFs.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 0:21About Us
- 1:53What is UAF
- 3:20Is it possible
- 3:39Zeroday samples
- 4:00Compatible meta tag
- 4:34Script function
- 6:19Problems of randomness
- 8:24What we learn
- 8:39IE engineers
- 9:14Flowchart
- 10:03First Version
- 12:37Third Version
- 13:58Explicit Pairing
- 15:42Examples
- 17:37Implicit Pairing
- 20:27Clear Attribute
- 22:28Pair Combination
- 23:33Test Cases
- 24:29Demo
- 26:32Implementation
- 26:50Experimentation
- 27:46Reboot
- 28:59Results
- 30:02Future Work
- 30:34Thank You
- 30:53QA
related talks
36mUnderstanding & explaining Use-After-Free vulnerability, a critical security flaw
51mWindows 10 Mitigation Improvements
47mUse After Free Exploitation
27mWIFI-Important Remote Attack Surface: Threat is Expanding
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
28mFuzzing Malware for Fun & Profit
45mThe Code Behind The Vulnerability
47mFrom Theory To Practice: Navigating The Challenges Of Vulnerability Research