Microsoft Edge – CMarkup::Ensure­Delete­CFState Use-After-Free (MS15-125)

• Exploit Database
• 106 阅读

• 作者： Skylined
  日期： 2016-12-06
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40878/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

  Source: http://blog.skylined.nl/20161201001.html   Synopsis   A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Edge. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.   Known affected software and attack vectors   Microsoft Edge 11.0.10240.16384   An attacker would need to get a target user to open a specially crafted web-page. Disabling Java­Script does not prevent an attacker from triggering the vulnerable code path.   Repro:   /<style>:first-letter{word-spacing:9   Variation:   x<style>:first-letter{background-position:inherit   Description   At the time this issue was first discovered, Mem­GC was just introduced, and I had not yet fully appreciated what an impact it would have on mitigating use-after-free bugs. Despite Mem­GC being enabled in Microsoft Edge by default, this issue appeared to me to have been a use-after-free vulnerability. However, both Microsoft and ZDI (whom I sold the vulnerability to) describes it as a memory corruption vulnerability, so it&apos;s probably more complex than I assumed.   At the time, I did not consider this vulnerability to be of great interest, as there was no immediately obvious way of controlling the vulnerability in order to exploit it. So, I did not do any further investigation into the root cause and, if this was indeed a use-after-free, how come Mem­GC did not mitigate it? In hindsight, it would have been a good idea to investigate the root cause, as any use-after-free that is not mitigated by Mem­GC might provide hints on how to find more vulnerabilities that bypass it.   Time-line   August 2015: This vulnerability was found through fuzzing. August 2015: This vulnerability was submitted to ZDI. December 2015: Microsoft addresses this vulnerability in MS15-125. December 2016: Details of this vulnerability are released.