exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Microsoft Internet Explorer 11 MSHTML CView::CalculateImageImmunity Use-After-Free

Microsoft Internet Explorer 11 MSHTML CView::CalculateImageImmunity Use-After-Free
Posted Nov 2, 2016
Authored by SkyLined

Setting the listStyleImage property of an Element object causes MSIE 11 to allocate 0x4C bytes for an "image context" structure, which contains a reference to the document object as well as a reference to the same CMarkup object as the document. When the element is removed from the document/document fragment, this image context is freed on the next "draw". However, the code continues to use the freed context almost immediately after it is freed.

tags | exploit
SHA-256 | 7c3474c2032d42f936d3ff0e59c7c8ce6f77233bc469225fdf7ba7bf031ca859

Microsoft Internet Explorer 11 MSHTML CView::CalculateImageImmunity Use-After-Free

Change Mirror Download
Throughout November, I plan to release details on vulnerabilities I
found in web-browsers which I've not released before. This is the second
entry in that series.

The below information is also available on my blog at
http://blog.skylined.nl/20161102001.html. There you can find a repro
that triggered this issue in addition to the information below.

Follow me on http://twitter.com/berendjanwever for daily browser bugs.

MSIE 11 MSHTML CView::CalculateImageImmunity UAF
================================================

(The fix and CVE number for this bug are not known)

Synopsis
--------
Setting the `listStyleImage` property of an Element object causes MSIE
11 to allocate 0x4C bytes for an "image context" structure, which
contains a reference to the document object as well as a reference to
the same `CMarkup` object as the document. When the element is removed
from the document/document fragment, this image context is freed on the
next "draw". However, the code continues to use the freed context almost
immediately after it is freed.

Known affected versions, attack vectors and mitigations
-----------------------
+ Microsoft Internet Explorer 11

An attacker would need to get a target user to open a specially
crafted webpage. As far as can be determined, disabling JavaScript
should prevent an attacker from triggering the vulnerable code path.

Exploit
-------
I tried a few tricks to see if there was an easy way to reallocate the
freed memory before the reuse, but was unable to find anything. I do not
know if there is a way to cause further reuse of the freed memory later
on in the code. Running the repro as-is without page heap does not
appear to trigger crashes. It does not appear that there is enough time
between the free and reuse to exploit this issue.

Repro.html:

<script>
var oDocumentFragment = document.createDocumentFragment(),
oElement = document.createElement('x');
oDocumentFragment.appendChild(oElement);
oElement.style.listStyleImage = "url(x)";
oDocumentFragment.removeChild(oElement);
</script>



Timeline
--------
* May 2014: This vulnerability was found through fuzzing.
* June 2014: This vulnerability was submitted to ZDI.
* July 2014: ZDI rejects the submission.
* November 2016: The issue does not reproduce in the latest build of
MSIE 11.
* November 2016: Details of this issue are released.

Unfortunately, my records of what happened after ZDI rejected the issue
are patchy. It appears that I did not pursue reporting the issue
anywhere else, but Microsoft does appear to have patched the issue, as I
can no longer reproduce it.

Cheers,

SkyLined



Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close