Control Flow Guard

[mikec31174872]

Starting with Windows 10, version 1703, when some users launch IE with Flash enabled, it crashes when interacting with a website that uses flash (i.e. abcnews.go.com) (see error message below).  After working with Microsoft, the issue is caused by Control Flow Guard (on Windows 10).  We are running the latest release of Flash (February 2018, as provided by Microsoft).  Error Pop-up = "Adobe Flash Player Utility has stopped working"  with Close the Program or Debug the Program as clickable options.

It appears to be compatibility issue with CFG.  Has Adobe seen this error and is there planned resolution for it?

[jeromiec83223024]

It's a crash, and something we'd be happy to look into.  I need much more specific information to do the engineering work required.

Here's a guide on providing a crash dump:

Report a Flash Player crash or error

As an aside, I would not describe this as a "compatibility issue with control flow guard".  Think of CFG like the airbags in your car.  It's protecting against an inappropriate write to memory.  You can't drive the car after the airbags are deployed because they obscure the windshield, but their job isn't to be compatible with driving.  In a similar vein, they're a symptom, not the problem, much like a telephone pole in the car analogy.  A crash dump is basically the black box in a car, and will tell me what events led up to the crash.

Thanks!

[mikec31174872]

Thank you for the reply from Friday.  On Monday 2/26, we did create and submit a Bug ID: FP-4198779, which also included a zip file and multiple dump files.  At any point soon, can we engage a living, breathing Adobe contact to work with us, either over the phone or E-Mails?  Thank you!

[Xpdite]

We have the same issue.  Not sure what it is that is causing it.  I do know that if I disable my computer GPO the problem goes away.  As soon as I put the GPO back it starts up again.  There has to be a setting in the GPO that is causing this but for the life of me I cannot find it.

[jeromiec83223024]

Yes, that fits with my intuition.  I don't believe that this happens in standard configurations.  I talk to the Edge team weekly.  Microsoft has good telemetry, and I'd be hearing about a new crash, even at moderate volumes.  Hopefully I'll have a better sense of why it's crashing after reviewing the dumps and can point you in the right direction.

[jeromiec83223024]

I posted this in the bug, but I'm just looping around here for completeness.  None of the crash dumps supplied gave me any useful information.  They're all basically empty.  The stack is empty, and all of the registers are null.  There's no information about what led up to the condition or what the machine was trying to do when it crashed.  Also, I noticed that the crash dumps were all for either our control panel applet (FlashPlayerApp.exe) or for Edge.  None were for Flash Player (Flash.ocx) itself.  For the Edge crashes, Flash Player wasn't ever listed as a loaded module, so I think it's probably crashing before we even get a chance to run.

If I could get my hands on a Virtual Machine with the same GPOs applied, or if there's some other way to import them all on a stock Win10 instance, then I could try and see what happens with a live debugging session.  If I can reproduce it, it would make things much easier.

[mikec31174872]

Currently working with - jeromiec83223024 on this Control Flow Guard Post. per his request, I have submitting
additional zip files (crashdump1,2&3.zip), to Bug ID FP-4198779, with new dumps created using Adobe's recommended processes. Thank you.

[Xpdite]

We have been working on a similar issue

In our group policy there is a setting

Computer configuration\Administrative
Templates\System\Mitigation Options for setting “Untrusted
Font Blocking

We have this enabled in our GPO but it seems when we change this to Disabled or enabled but not blocking then our problem goes away.

Check that out and see if you have a similar setting

[jeromiec83223024]

That's fantastic feedback, thank you!  I'll get a bug going for investigation.

[jeromiec83223024]

Also, do you have a URL that consistently reproduces this for you?  There's no guarantee that our engineers are going to get the same banner ads on ABC News.  If there's something that does this 100% of the time, that will definitely speed the work along.

[Xpdite]

Adobe - Flash Player

[jeromiec83223024]

Perfect, thanks.  That should speed things along.

[Xpdite]

Seems as thought the font setting in our GPO has not resolved the issue after all but it is definitely related to the CFG settings.  If we disable that, our issue goes away.

[jeromiec83223024]

This fits with what we're seeing.  Our analysis of the logs from the original poster indicates that the crash is happening in underlying Windows APIs, and has to do with interplay between EDP and CFG in Win10 RS3.

[jeromiec83223024]

Adobe doesn't offer direct support for free products. 

If your organization has an enterprise support agreement with Adobe, you can work with your named support representative.  If your organization is interested in purchasing an enterprise support agreement, I'm sure that our sales team would be more than happy to talk to you about the available options.

There are details on our enterprise support programs here:

https://helpx.adobe.com/support/programs/enterprise-support-programs.html

That said, I'll be happy to take a look at the crash dumps this afternoon.  Just to set expectations, this isn't something that's going to get resolved in a few days.

Updates on Windows 10 are controlled by Microsoft, and are made available via Windows Update.  Releases generally happen monthly, on patch Tuesday, and fixes ship on the next available launch vehicle as they become available.  You're looking at weeks or months before a patch would land in production.