3

I want to learn more about use-after-free vulnerabilities and found this tutorial. Yet I don't understand it very well and hope for an explanation of how it works.

1
  • However unrelated this may be from the topic, Computerphile does a good job simplifying problems in CS in general. The linked video might help you nontheless the apparent off-topic-ness.
    – Tobi Nary
    Mar 23, 2016 at 23:00

1 Answer 1

5

There are programming languages like C or C++ where the program has to manually allocate and deallocate memory to store its data. After memory was deallocated, that memory can be reused to store other data. However, even after a C program has officially deallocated a block of memory, it can still read from it and write to it. If this happens it is practically always an unintended bug. In many cases the compiler and the operating system can detect when this happens and have the program crash, but it is not possible to catch every eventuality.

That means the program believes it is reading or writing one piece of data (which should actually be no longer relevant), but does this with some other, completely unrelated piece of data which was stored there in the meantime. This can, for example, result in data being overwritten with data provided by the attacker or result in confidential data being read and finding its way into the program's output.

Regarding how to exploit this: There is no universally applicable answer because the situations in which use-after-free's occur are heavily dependent on the application.

2
  • Thanks, but how the vtable gets overwritten on this javascript code?
    – user104787
    Mar 24, 2016 at 7:02
  • It's because of a bug in the javascript interpreter in Internet Explorer. Note that the bug is fixed since 2013, so you will likely be unable to reproduce it. MSIE is not open source, so we can not know how the bug looks in the C++ code of it.
    – Philipp
    Mar 24, 2016 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .