Questions tagged [use-after-free]

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code

Filter by
Sorted by
Tagged with
1
vote
0answers
37 views

Why does hydraqs exploit put “abc” in its x1 array?

Here there is a thorough description of the exploit I am talking about. There is this step: var x1 = new Array(); for (i = 0; i < 200; ++i) { x1[i] = document.createElement("COMMENT"); x1[...
0
votes
1answer
207 views

What famous attacks used a use-after-free vulnerability?

I'm compiling vulnerabilities and related attacks, and I need to find a famous attack that exploited a use-after-free vulnerability. I've looked for a while though I can't seem to find any. I know ...
1
vote
0answers
167 views

Exploitability of Heap Vulnerabilities

I'm researching memory safety vulnerabilities and noticed that in non-browser applications (for example the Linux kernel) the CVE details entries for use-after-free vulnerabilities almost always list ...
-2
votes
2answers
2k views

How to find Use-After-Free vulnerabilities? [closed]

I followed a lot of tutorials about the exploitation of UAF vulnerabilities, but there was never explained how to find and detect UAF vulnerabilities in JavaScript or HTML (i.e. with a static analysis)...
3
votes
0answers
161 views

Lookaside List Injection

I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside ...