In December 2018, Mozilla released Firefox version 64 via , and we’ve seen vendors implement sweeping . Upon return from the nsContentUtils::MaybeFireNodeRemoved function, the freed select object is used to read a pointer that triggers a read access violation:
Figure 8 - Triggering the Read Access Violation
One interesting note here is that if right branch was taken, the exact same function (nsINode::ReplaceOrInsertBefore) will be called, but just before this call, the AddRef function will be used to increase the reference count of the select object. Consequently, no use-after-free will occur:
Figure 9 - Avoiding the UAF via the AddRef Function
The Patch
Mozilla patched this vulnerability via changeset Google Chrome used a UAF vulnerability. UAFs exist beyond the browser, too. The Linux kernel released a and follow the team for the latest in exploit techniques and security patches.
SOCIAL SHARE CARD GENERATOR