CVE-2015-1722
published 2015-06-10CVE-2015-1722: Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1…
PriorityP339high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
3.48%
87.8th percentile
Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Bitmap Handling Use After Free Vulnerability."
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_server_2003 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2012 | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (1)
exploitdb·2015-09-22
CVE-2015-1722 Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (1)
Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (1)
---
Source: https://code.google.com/p/google-security-research/issues/detail?id=293
Platform: Win7 32-bit.
trigger.cpp should fire the issue, with two caveats:
- PoC will NOT work if compiled as a debug build.
- PoC will trigger the condition every time but the subsequent corruption might not cause a crash every time. It may be necessary to run the PoC multiple times.
debug.txt is a sample crash log.
Analysis from Nils:
---
Using the series of calls we are able to free the bitmap object, a reference to this object still exists in the trigger process after killing the first notepad process.
At this time we are able to replace the freed object in memory. We are not able to reuse this object through the original h
Exploit-DB
Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (2)
exploitdb·2015-09-22
CVE-2015-1722 Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (2)
Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (2)
---
Source: https://code.google.com/p/google-security-research/issues/detail?id=311
Bitmap object Use-after-Free #2
The attached PoC triggers a blue screen due to a use after free vulnerability. The crashes are unreliable, however you can use Special Pool in order to get reliable crashes. The crashes indicate that it is possible to write to arbitrary addresses.
---
please find the PoC and brief analysis for the issue attached. The analysis mentions how Special Pool can be used to get very reliable crashes, it should crash without Special Pool after a while as well.
--
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38265.zip
http://www.securitytracker.com/id/1032525https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-061https://www.exploit-db.com/exploits/38265/https://www.exploit-db.com/exploits/38275/http://www.securitytracker.com/id/1032525https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-061https://www.exploit-db.com/exploits/38265/https://www.exploit-db.com/exploits/38275/
2015-06-10
Published