VLC media player 3.0.6 and earlier: Read buffer overflow and double free • Hacker News Board

Re: VLC media player 3.0.6 and earlier: Read buffer overflow and double free

#11

Post by vardump » Fri, Jun 28, 2019, 10:13 PM UTC

MuffinFlavored wrote: post #10

vardump wrote: post #7

Earlier quoted context omitted.

Not sure what you mean. There was no mention about executing anything in the heap (or stack for that matter). I have no reason to believe VLC maps (a part of) its heap RWX (=read + write + execute). This kind of exploits don't even require memory to be executable. C++ virtual methods cause the compiler to add vPtr (that is writable, because it's contained in the object) and vTable. Modifying vPtr can be used for maki…

> This kind of exploits don't even require memory to be executable. If this exploit is a memory leak, and the memory isn't executable, how do the malicious contents that get put into the leaked memory get executed?

Possibly through a ROP chain. Abusing VLC's code itself. You don't need memory that's writeable and executable for that. Check the Wikipedia link in my comment about ROP exploits.

Re: VLC media player 3.0.6 and earlier: Read buffer overflow and double free

#12

Post by ec109685 » Fri, Jun 28, 2019, 11:47 PM UTC

vardump wrote: post #8

ryacko wrote: post #6

Personal preference to avoid these sorts of exploits is by using a virtual machine with a browser VM from Microsoft, although by default those browser VMs are run in admin mode.

Be aware that there have been plenty of virtual machine escape vulnerabilities. If enough people did same, the attackers would start to exploit that vector. Or a target interesting enough. VLC might run quite a bit worse as well, because hardware video decoding is most likely unavailable in a VM.

Exploits around hardware implementation of bitstream deciding is more of a constrained problem than arbitrary and legacy file formats that vlc needs to decode.

Would like it if OS’s ran binaries in micro-vms by default. At least with a very much de-privileged container.

Re: VLC media player 3.0.6 and earlier: Read buffer overflow and double free

#13

Post by gubbrora » Sat, Jun 29, 2019, 2:39 PM UTC

vardump wrote: post #11

MuffinFlavored wrote: post #10

Earlier quoted context omitted.

> This kind of exploits don't even require memory to be executable. If this exploit is a memory leak, and the memory isn't executable, how do the malicious contents that get put into the leaked memory get executed?

Possibly through a ROP chain. Abusing VLC's code itself. You don't need memory that's writeable and executable for that. Check the Wikipedia link in my comment about ROP exploits.

Just elaborating on this. One way of looking at it is that we turn the attacked program into an interpreter thus bypassing the requirement for executability.

It turns out that a lot of programs can be tricked into interpreting a family of languages called rop chains.