CVE-2015-8048

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's URLStream.readObject method. When reading a serialized object of a registered class, the class constructor is invoked. If the constructor calls URLStream.close(), the URLStream object is freed, but subsequent deserialization code continues to write to the freed memory, leading to a use-after-free condition [1]. This affects Flash Player versions before 18.0.0.268 and 19.x, 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as Adobe AIR versions before 20.0.0.204 [2].

Exploitation

Exploitation requires an attacker to deliver a crafted SWF file that triggers the vulnerable code path. The attacker must register a class alias and define a class whose constructor calls URLStream.close() on a global reference. The SWF then loads a file and calls readObject() on a URLStream. When the deserialized object is of the registered class, the constructor executes, freeing the stream, and the subsequent write operation accesses freed memory. This can be leveraged to execute arbitrary code [1].

Impact

Successful exploitation allows arbitrary code execution in the context of the user running Flash Player. An attacker could gain full control over the affected system [2]. The vulnerability is considered critical with no authentication required.

Mitigation

Adobe has released fixed versions: Flash Player 20.0.0.228 (Windows/OS X), 18.0.0.268 (Windows/OS X), and 11.2.202.554 (Linux). Adobe AIR updated to 20.0.0.204. Users should upgrade immediately. For Linux, Gentoo recommends version 11.2.202.559 (later patch) [2]. No workarounds are available.