Internet Bug Bounty: Adobe Flash Player Uninitialised Memory Corruption

##Description

A Uninitialised Memory Corruption exist in Adobe Flash Player SA for Mac (test in v20.0.0.228 sa version)，successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system.

##Environment

1、Mac OSX 10.11.2
2、flashplayer20_0d0_228_mac_sa

##Details

valgrind --tool=memcheck /Users/riusksk/Downloads/Flash\ Player.app/Contents/MacOS/Flash\ Player poc.swf

==3453== Memcheck, a memory error detector

==3453== Copyright © 2002-2015, and GNU GPL’d, by Julian Seward et al.

==3453== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info

==3453== Command: /Users/riusksk/Downloads/Flash\ Player.app/Contents/MacOS/Flash\ Player poc.swf

==3453==

==3453== Conditional jump or move depends on uninitialised value(s)

==3453== at 0x7FFF5FC24A27: bcmp (in /usr/lib/dyld)

==3453== by 0x7FFF5FC11914: ImageLoaderMachO::validateFirstPages(linkedit_data_command const*, int, unsigned char const*, unsigned long, long long, ImageLoader::LinkContext const&) (in /usr/lib/dyld)

==3453== by 0x7FFF5FC16B8A: ImageLoaderMachOCompressed::instantiateFromFile(char const*, int, unsigned char const*, unsigned long, unsigned long long, unsigned long long, stat const&, unsigned int, unsigned int, linkedit_data_command const*, encryption_info_command const*, ImageLoader::LinkContext const&) (in /usr/lib/dyld)

==3453== by 0x7FFF5FC10A7E: ImageLoaderMachO::instantiateFromFile(char const*, int, unsigned char const*, unsigned long long, unsigned long long, stat const&, ImageLoader::LinkContext const&) (in /usr/lib/dyld)

==3453== by 0x7FFF5FC038C2: dyld::loadPhase6(int, stat const&, char const*, dyld::LoadContext const&) (in /usr/lib/dyld)

==3453== by 0x7FFF5FC0846D: dyld::loadPhase5(char const*, char const*, dyld::LoadContext const&, std::__1::vector<char const*, std::__1::allocator<char const*> >*) (in /usr/lib/dyld)

==3453== by 0x7FFF5FC0818D: dyld::loadPhase4(char const*, char const*, dyld::LoadContext const&, std::__1::vector<char const*, std::__1::allocator<char const*> >*) (in /usr/lib/dyld)

==3453== by 0x7FFF5FC07EF2: dyld::loadPhase3(char const*, char const*, dyld::LoadContext const&, std::__1::vector<char const*, std::__1::allocator<char const*> >*) (in /usr/lib/dyld)

==3453== by 0x7FFF5FC07647: dyld::loadPhase1(char const*, char const*, dyld::LoadContext const&, std::__1::vector<char const*, std::__1::allocator<char const*> >*) (in /usr/lib/dyld)

==3453== by 0x7FFF5FC0347A: dyld::loadPhase0(char const*, char const*, dyld::LoadContext const&, std::__1::vector<char const*, std::__1::allocator<char const*> >*) (in /usr/lib/dyld)

==3453== by 0x7FFF5FC0315E: dyld::load(char const*, dyld::LoadContext const&) (in /usr/lib/dyld)

==3453== by 0x7FFF5FC0870A: dyld::libraryLocator(char const*, bool, char const*, ImageLoader::RPathChain const*) (in /usr/lib/dyld)

==3453==

==3453== Use of uninitialised value of size 8

lldb Flash\ Player

(lldb) target create “Flash Player”

warning: (x86_64) /Users/riusksk/Downloads/Flash Player.app/Contents/MacOS/Flash Player empty dSYM file detected, dSYM was created with an executable with no debug info.

Current executable set to ‘Flash Player’ (x86_64).

(lldb) run ~/Downloads/poc.swf

Process 96650 launched: ‘/Users/riusksk/Downloads/Flash Player.app/Contents/MacOS/Flash Player’ (x86_64)

Vector smash protection is enabled.

Process 96650 stopped

• thread #1: tid = 0xbbffa, 0x00007fff82cc0b4f CoreFoundation`CFStringGetLength + 15, queue = ‘com.apple.main-thread’, stop reason = EXC_BAD_ACCESS (code=1, address=0x0)

frame #0: 0x00007fff82cc0b4f CoreFoundation`CFStringGetLength + 15

CoreFoundation`CFStringGetLength:

-> 0x7fff82cc0b4f <+15>: movq (%rbx), %rax

0x7fff82cc0b52 <+18>: testq %rax, %rax

0x7fff82cc0b55 <+21>: je 0x7fff82cc0b97 ; <+87>

0x7fff82cc0b57 <+23>: leaq -0xff65e76(%rip), %rcx ; __CFConstantStringClassReferencePtr

(lldb) bt

• thread #1: tid = 0xbbffa, 0x00007fff82cc0b4f CoreFoundation`CFStringGetLength + 15, queue = ‘com.apple.main-thread’, stop reason = EXC_BAD_ACCESS (code=1, address=0x0)

• frame #0: 0x00007fff82cc0b4f CoreFoundation`CFStringGetLength + 15

frame #1: 0x00007fff82df89cc CoreFoundation`_CFURLCreateWithFileSystemPath + 60

frame #2: 0x000000010040d204 Flash Player`main + 165412

frame #3: 0x0000000100394bb4 Flash Player`___lldb_unnamed_function14212$$Flash Player + 356

frame #4: 0x00000001004053e8 Flash Player`main + 133128

frame #5: 0x000000010040563e Flash Player`main + 133726

frame #6: 0x000000010039630a Flash Player`___lldb_unnamed_function14228$$Flash Player + 10

frame #7: 0x00000001001032fd Flash Player`___lldb_unnamed_function2712$$Flash Player + 13

frame #8: 0x000000010034863c Flash Player`___lldb_unnamed_function12938$$Flash Player + 844

frame #9: 0x000000010034824c Flash Player`___lldb_unnamed_function12937$$Flash Player + 764

frame #10: 0x0000000100342843 Flash Player`___lldb_unnamed_function12890$$Flash Player + 1203

frame #11: 0x00000001003421ef Flash Player`___lldb_unnamed_function12888$$Flash Player + 559

frame #12: 0x00000001002fd32c Flash Player`___lldb_unnamed_function12368$$Flash Player + 540

frame #13: 0x0000000100301438 Flash Player`___lldb_unnamed_function12395$$Flash Player + 968

frame #14: 0x0000000100302447 Flash Player`___lldb_unnamed_function12397$$Flash Player + 1527

frame #15: 0x0000000100309957 Flash Player`___lldb_unnamed_function12454$$Flash Player + 535

frame #16: 0x0000000100308e12 Flash Player`___lldb_unnamed_function12453$$Flash Player + 770

frame #17: 0x0000000100350dc3 Flash Player`___lldb_unnamed_function12977$$Flash Player + 371

frame #18: 0x000000010039702a Flash Player`___lldb_unnamed_function14247$$Flash Player + 138

frame #19: 0x0000000100405546 Flash Player`main + 133478

frame #20: 0x000000010040563e Flash Player`main + 133726

frame #21: 0x000000010039630a Flash Player`___lldb_unnamed_function14228$$Flash Player + 10

frame #22: 0x00000001001032fd Flash Player`___lldb_unnamed_function2712$$Flash Player + 13

frame #23: 0x000000010034863c Flash Player`___lldb_unnamed_function12938$$Flash Player + 844

frame #24: 0x00000001003489b4 Flash Player`___lldb_unnamed_function12939$$Flash Player + 436

frame #25: 0x00000001003e2499 Flash Player`___lldb_unnamed_function15719$$Flash Player + 1145

frame #26: 0x00000001003e29ee Flash Player`___lldb_unnamed_function15722$$Flash Player + 46

frame #27: 0x00007fff8c0fb2c4 AppKit`-[NSApplication _doOpenFile:ok:tryTemp:] + 315

frame #28: 0x00007fff8bd26775 AppKit`-[NSApplication finishLaunching] + 1557

frame #29: 0x00007fff8bd25e05 AppKit`-[NSApplication run] + 231

frame #30: 0x00007fff8bca8520 AppKit`NSApplicationMain + 1176

frame #31: 0x0000000100001784 Flash Player`___lldb_unnamed_function1$$Flash Player + 52

##Reference
riusksk of Tencent Security Platform Department (CVE-2016-0992):
https://helpx.adobe.com/security/products/flash-player/apsb16-08.html