1

I'm researching memory safety vulnerabilities and noticed that in non-browser applications (for example the Linux kernel) the CVE details entries for use-after-free vulnerabilities almost always list UAFs as denial of service errors, not remote code execution errors. They even mention UAFs every time a denial of service is mentioned in the report (i.e. they all say something like "this vulnerability can be used to cause a denial of service (use-after-free)"). Is there some special case that makes UAFs lead to code execution in the context of a browser application but not in any other context? I've heard that heap-related errors (including UAFs) tend to be unreliable due to the unknown layout of the heap at the time of exploitation unless the attacker has some method of "massaging" the heap layout, of which the most common method is using Javascript or some other scripting language. Is this reason (the use of Javascript) the reason why use-after-free vulnerabilities are referred to as code execution vulnerabilities in the context of a browser but a denial of service in the context of other programs?

On a related note, I've heard that the presence of some sort of scripting environment (Javascript, Flash, etc) is required in a lot of cases to exploit infoleak bugs (for example leaking a pointer to defeat ASLR) when the attacker doesn't yet have access to the computer and the program being attacked can't be remotely interacted with, for example when an attacker is attempting to exploit a browser vulnerability. Is this true?

Finally, what kind of programs have the highest proportion of format string attacks? I tried looking them up for a variety of commonly used programs (different browsers, openssh, openvpn, openssl, Adobe Flash, the V8 Javascript engine, and various http servers), and I could only find two format string vulnerabilities in all, one of which could only be used to read memory and not perform an arbitrary write. Then I googled "format string cve details," and almost every single result on the first several pages was a vulnerability in PHP. Are scripting languages particularly vulnerable to format string vulnerabilities?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.