0

This question already has an answer here:

I use Ubuntu and last firefox version.

I opened an image with firefox, and a crash occurred.

Let's assume it's a crafted jpg to run an exploit, and execute arbitrary code.

To sum up: (1) Firefox opens a crafted JPG ->(2) Firefox crashes ->(3) Arbitrary code try to run

--

Step 3: According to Are exploits platform dependent?, exploits are platform dependent.

My question is about step 2: A bug is the origin of the crash. The crafted jpg uses this bug.

Can crash occurs on every platform ? If yes, so it will be harmful only for one OS ?

Thank you

marked as duplicate by TildalWave, Jens Erat, Dog eat cat world, Rory Alsop Feb 2 '15 at 8:39

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3

Exploits are typically platform dependent, although the vulnerability might not be.

In this case it depends on whether the crash is in firefox, or some underlying library. If we're talking about a JPG for instance, the crash may be resulting from an error in libjpg, in which case it is probably not going to be cross platform.

However, if the crash is in some firefox specific code that is cross platform, there is a chance that the vulnerability will exist on multiple platforms. Whether or not the vulnerability can be exercised to produce RCE is another question though. There are a lot of variables in this case, including the compiler, the optimizations done by the compiler, stack layout, possible calling convention differences, the heap allocation algorithm used by the OS and many other elements. The crash may exist on both systems, but it is possible that only one is reliably exploitable. It may also be the case that one operating system is exploitable by this single vulnerability, while the other might be vulnerable when another vulnerability is exercised in conjunction with the original bug (think memory disclosure or arbitrary write bug).

In the case that the vulnerability exists on both platforms and can be exercised, the exploit code and shell-code will likely be very different. Assuming at least one of the operating systems uses DEP, your ROP chain is going to be very different, as are the locations of the ROP gadgets. If exercising the vulnerability requires any kind of heap grooming, you are going to find that heaps vary greatly between different operating systems, and even between different versions of the same OS.

There is not simple answer to this question, as it is highly situation dependent. In theory though, it is possible for cross platform code to contain a bug that is vulnerable to exploitation on multiple different platforms. It is much less likely though that the procedure used to exercise the vulnerability will be the same.

  • 1
    It also depends on the specific nature of the vulnerability. If a bug in Firefox allows an attacker to get the Firefox password data sent to him, that may well be cross-platform (if it's in the platform-independent parts of Firefox code, it probably is). – cpast Feb 1 '15 at 17:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.