Detecting Reference Counting Vulnerabilities in COM Objects

Component Object Model (COM) is a fundamental binary-interface technology developed by Microsoft, designed to facilitate the creation and interaction of software components in a language-neutral strategy and is widely deployed on the latest Windows Opeating systems. The lifecycle of COM objects are managed with a key class variable: reference counter. In this paper, we propose a new way to attack COM objects through abusing its reference counting mechanism, through our research, we successfully find 8 bugs in COM reference counting mechanism. We submit the vulnerablities to Microsoft and all of them are properly fixed and confirmed by the Common Vulnerabilities and Exposures (CVE) database.