Does CMF protect against this?

Help
1
2

I believe not, if you’re referring to the general technique involved.

3

Well if not why not? it’s still a buffer overflow at it’s core so why not

4

It seems that this is a new technique for exploiting null pointer references, previously thought to have been extremely difficult to exploit. Does the general technique always rely on a buffer exploit? (I don’t mean just this specific case with Flash)

5

To answer my own question, the answer is no. Please see Justin Schuh (@jschuh@infosec.exchange) - Infosec Exchange for a simple example of this class of exploit. Also, I started a topic about this at Null pointer exploit excites researchers | Wilders Security Forums.

6

In the event that the null pointer came about because of a failure of a memory allocation function, perhaps CMF would offer protection. Justin Schuh (@jschuh@infosec.exchange) - Infosec Exchange provides a simple example that could be compiled and tested with CMF.

7

Hi, this depends on the exploit’s code, if it uses the stack/heap for the shellcode the CMF will detect this if it uses just preallocated memory CMF will not detect this. Actually this is not a BO in common meaning, but this can be detected by “on fly” signatures scanning. Exploits are generaly BO-exploits, but not in all cases, I saw many “popular” so called “exploits-suites” and ~20% of their exploits were not bugs (means BO holes) at all, just some insecure ActiveX methods or something like this.

8

What about in the specific case of, let’s say, a call to calloc() fails (in other words, no memory is allocated but should have been), and then later on this (null) pointer has an offset added to it, and then the resulting memory location is written to? For example, if the calloc function in the example at Justin Schuh (@jschuh@infosec.exchange) - Infosec Exchange fails, and setSquare is subsequently called, will CMF alert on the setSquare call that dereferences a null pointer+offset?

9

No, ofcourse CMF will not say anything till that will be exploited to “jmp” somewhere to execute the shellcode.

10

Locked.

Reason: Out-Dated post.

Josh