6

According to the Windows Internals 5th Edition book, the 5-bit ASLR bias for heaps is "multiplied by 64KB to generate the final base address, starting at 0, giving a possible range of 0x00000000 to 0x001F0000 for the initial heap". As such, the initial heap for IE on Windows 7 will always be between 0x00000000 and 0x001F0000, with 32 possible locations. By ...


4

No, heap spray can be used for any exploit that needs heap data to be aligned a certain way. Example include the ExternalBlue exploit that targets SMB. It heaps sprays a bunch of SMB objects to align the memory, so that the right objects get corrupted.


4

The general idea is to embed shellcode in a bitmap which a browser loads into the heap. The original presentation discussing this technique is Punk Ode: Hiding Shellcode in Plain Sight. Also discussed in this paper is using code embedded in a gif to create an exploitable heap overflow in NetScape 6.x, x86 Linux RedHat 7.0, 15 years ago (slide 9). As for ...


4

The point of a spray is that you don't always know exactly which block your object was allocated to. I believe it's because how volatile the heap can be. At any given time a block of memory could be allocated, and your NOP sled/shellcode could be interrupted. You see examples with predictable addresses because it makes it easier to learn the concept, but ...


3

There are two distinct questions here: How easy is it to trigger the vulnerability? In other words, how easy is it to make the program do something it isn't supposed to do? How severe is the vulnerability? In other words, if you can trigger it, what can you do with it? The answer to the first question is: very easy. VLC is a video player, and you can ...


3

The reason why CVSS scores are high, even though an issue is difficult to exploit, is because CVSS ignores the likelihood of some things. For example, if an exploit requires the user to open a media file, it gets the attribute "User interaction required". An exploit that would require the user to ignore an explicit warning also gets the attribute "User ...


2

For basic types, such as long or array, I can't think of a way remote execution could be achieved. With classes, there are many options beyond virtual table. For example a member class may have a virtual table. A shared pointer could also be used, as it contains a pointer to destructor function. Other more exotic cases such as a destructor calling a function ...


Only top voted, non community-wiki answers of a minimum length are eligible