CVE-2015-3042 : Detail

CVE-2015-3042

81.5%V3
Network
2015-04-14
20h00 +00:00
2017-09-16
07h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3043.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE Other No informations.

Metrics

Metrics Score Severity CVSS Vector Source
V2 10 AV:N/AC:L/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 37839

Publication date : 2015-08-18 22h00 +00:00
Author : Google Security Research
EDB Verified : Yes

Source: https://code.google.com/p/google-security-research/issues/detail?id=224&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There’s an error in the PCRE engine version used in Flash that allows the execution of arbitrary PCRE bytecode, with potential for memory corruption and RCE. This issue is a duplicate of http://bugs.exim.org/show_bug.cgi?id=1546 originally reported to PCRE upstream by mikispag; I rediscovered the issue fuzzing Flash so have filed this bug report to track disclosure deadline for Adobe. The issue occurs in the handling of zero-length assertions; ie assertions where the object of the assertion is prepended with the OP_BRAZERO operator. Simplest testcase that will crash in an ASAN build is the following: (?(?<a>)?) This is pretty much a nonsense expression, and I'm not sure why it compiles successfully; but it corresponds to the statement that 'assert that named group 'a' optionally matches'; which is tautologically true regardless of 'a'. Regardless, we emit the following bytecode: 0000 5d0012 93 BRA [18] 0003 5f000c 95 COND [12] 0006 66 102 BRAZERO 0007 5e00050001 94 CBRA [5, 1] 000c 540005 84 KET [5] 000f 54000c 84 KET [12] 0012 540012 84 KET [18] 0015 00 0 END When this is executed, we reach the following code: /* The condition is an assertion. Call match() to evaluate it - setting the final argument match_condassert causes it to stop at the end of an assertion. */ else { RMATCH(eptr, ecode + 1 + LINK_SIZE, offset_top, md, ims, NULL, match_condassert, RM3); if (rrc == MATCH_MATCH) { condition = TRUE; ecode += 1 + LINK_SIZE + GET(ecode, LINK_SIZE + 2); while (*ecode == OP_ALT) ecode += GET(ecode, 1); <---- ecode is out of bounds at this point. If we look at the execution trace for this expression, we can see where this code goes wrong: exec 0x600e0000dfe4 93 [0x60040000dfd0 41] exec 0x600e0000dfe7 95 [0x60040000dfd0 41] exec 0x600e0000dfea 102 [0x60040000dfd0 41] <--- RMATCH recursive match exec 0x600e0000dfeb 94 [0x60040000dfd0 41] exec 0x600e0000dff0 84 [0x60040000dfd0 41] exec 0x600e0000dff3 84 [0x60040000dfd0 41] exec 0x600e0000dff6 84 [0x60040000dfd0 41] exec 0x600e0000dff9 0 [0x60040000dfd0 41] <--- recursive match returns before 0x600e0000dfe7 24067 <--- ecode == 0x...dfe7 after 0x600e00013dea If we look at the start base for our regex, it was based at dfe4; so dfe7 is the OP_COND, as expected. Looking at the next block of code, we're clearly expecting the assertion to be followed by a group; likely OP_CBRA or another opcode that has a 16-bit length field following the opcode byte. ecode += 1 + LINK_SIZE + GET(ecode, LINK_SIZE + 2); In this case, the insertion of the OP_BRAZERO has resulted in the expected OP_CBRA being shifted forward by a byte to 0x...dfeb; and this GET results in the value of 0x5e00 + 1 + LINK_SIZE being added to the ecode pointer, instead of the correct 0x0005 + 1 + LINK_SIZE, resulting in bytecode execution hopping outside of the allocated heap buffer. See attached for a crash PoC for the latest Chrome/Flash on x64 linux. https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37839.zip

Products Mentioned

Configuraton 0

Adobe>>Flash_player >> Version To (including) 11.2.202.451

Linux>>Linux_kernel >> Version -

Configuraton 0

Adobe>>Flash_player >> Version To (including) 13.0.0.264

Adobe>>Flash_player >> Version 14.0.0.125

Adobe>>Flash_player >> Version 14.0.0.145

Adobe>>Flash_player >> Version 14.0.0.176

Adobe>>Flash_player >> Version 14.0.0.179

Adobe>>Flash_player >> Version 15.0.0.152

Adobe>>Flash_player >> Version 15.0.0.167

Adobe>>Flash_player >> Version 15.0.0.189

Adobe>>Flash_player >> Version 15.0.0.223

Adobe>>Flash_player >> Version 15.0.0.239

Adobe>>Flash_player >> Version 15.0.0.246

Adobe>>Flash_player >> Version 16.0.0.235

Adobe>>Flash_player >> Version 16.0.0.257

Adobe>>Flash_player >> Version 16.0.0.287

Adobe>>Flash_player >> Version 16.0.0.296

Adobe>>Flash_player >> Version 17.0.0.134

Apple>>Mac_os_x >> Version -

Microsoft>>Windows >> Version -

Configuraton 0

Opensuse>>Opensuse >> Version 13.1

Opensuse>>Opensuse >> Version 13.2

Suse>>Suse_linux_enterprise_desktop >> Version 11.0

Suse>>Suse_linux_enterprise_desktop >> Version 12.0

    Suse>>Suse_linux_workstation_extension >> Version 12.0

      Configuraton 0

      Redhat>>Enterprise_linux_desktop_supplementary >> Version 5.0

      Redhat>>Enterprise_linux_desktop_supplementary >> Version 6.0

      Redhat>>Enterprise_linux_server_supplementary >> Version 5.0

      Redhat>>Enterprise_linux_server_supplementary >> Version 6.0

      Redhat>>Enterprise_linux_server_supplementary_eus >> Version 6.6.z

      Redhat>>Enterprise_linux_workstation_supplementary >> Version 6.0

      References

      https://www.exploit-db.com/exploits/37839/
      Tags : exploit, x_refsource_EXPLOIT-DB
      http://www.securityfocus.com/bid/74062
      Tags : vdb-entry, x_refsource_BID
      https://security.gentoo.org/glsa/201504-07
      Tags : vendor-advisory, x_refsource_GENTOO
      http://www.securitytracker.com/id/1032105
      Tags : vdb-entry, x_refsource_SECTRACK
      http://rhn.redhat.com/errata/RHSA-2015-0813.html
      Tags : vendor-advisory, x_refsource_REDHAT