Hey Man, Have You Forgotten To Intialize Your Memory?
summary
A single uninitialized CAttributeValue in 64‑bit IE leads to an info leak via a relative heap spray, allowing construction of fake VARIANTs and a fake JS array to get arbitrary read/write and bypass CFG/ASLR; the exploit pops calc in the 64‑bit IE child and then uses an install broker TOCTOU (replace verified EXE between verify and run, writing via the Flash broker) to elevate to medium integrity. Two 0‑days used and later patched.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 3:10Overview of vulnerabilities
- 5:22Uninitialized memory bug
- 31:56Remote code execution demo
- 33:37IE sandbox bypass
- 45:24Sandbox escape demo and end
related talks
35mOn Securing Legacy Software Against Code-Reuse Attacks
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
33mOver the Edge: Silently Owning Windows 10's Secure Browser
01h 00mIntroduction to memory exploitation
51mWindows 10 Mitigation Improvements
47mUse After Free Exploitation
50mWrite Once, Pwn Anywhere
24mThe Memory of a Meltdown