Usually Flash exploits need to be specifically targeted at an OS (Linux v.s. Windows v.s. whatever). An attacker can choose to shove as many into one exploit, which would likely cause suspicion if my exploit crashes while exploiting, or make something reliable, I can use and re-use. This means the law of averages: "How many people use Windows, and how many use Linux. Where would my exploit yield better results?" If I am not specifically targeting you per-se.
Flash is usually used to deliver another payload. Whether or not the payload is specifically aimed at Windows, is what is relevant. Most Flash based exploits on their own (non payload deliverable) still need to be specifically targeted at you. Let's look at an advisory:
Adobe Flash Player before 188.8.131.52 and 14.x and 15.x before
184.108.40.206 on Windows and OS X and before 220.127.116.118 on Linux, Adobe AIR before 18.104.22.1686, Adobe AIR SDK before 22.214.171.1246, and Adobe AIR
SDK & Compiler before 126.96.36.1996 allow attackers to execute arbitrary
code or cause a denial of service (memory corruption) via unspecified
vectors, a different vulnerability than CVE-2014-0576, CVE-2014-0581,
If I as an attacker tried to make an exploit to send to you, there are multiple ways to get it to you. But here are the hurdles I would face trying to exploit you.
- Step 1) create shellcode to do the harm I need to do
- Step 2) obfuscate this shellcode so it is not detected by AV
Before I even do this, I have an altogether different choice... Pick my target to exploit: Will I focus on Linux, or Windows?!? Because each is a different operating system, my payloads will differ.
IOW you're confusing how attackers use Flash to exploit an operating system. Flash is usually nothing more than a vehicle to deliver something more malicious.
Imagine if you can a country named Chickenphobia where everyone is allergic to chickens. If anyone comes in contact with a chicken, they will become sick. Now imagine a bus, airplane, boat or truck delivering Chickens (with the intentions of making people in Chickenphobia sick) to the wrong town. The vehicles (bus, truck, boat, train, plain) are Flash. It is nothing more than a delivery mechanism.
-- END OF ANALOGY