Chrome Blink SpeechRecognitionController Use-After-Free Exploit

🗓️ 24 Nov 2016 00:00:00Reported by SkyLinedType

zdt🔗 0day.today👁 51 Views

Chrome Blink SpeechRecognitionController use-after-free exploit in 39.

Reporter	Title	Published	Views	Family All 48
0day.today	Google Chrome SpeechRecognitionClient Use-After-Free Remote Code Execution Vulnerability	24 May 201500:00	–	zdt
Tenable Nessus	Google Chrome < 43.0.2357.65 Multiple Vulnerabilities	16 Jun 201500:00	–	nessus
Tenable Nessus	Debian DSA-3267-1 : chromium-browser - security update	26 May 201500:00	–	nessus
Tenable Nessus	FreeBSD : chromium -- multiple vulnerabilities (a9d456b4-fe4c-11e4-ad15-00262d5ed8ee)	20 May 201500:00	–	nessus
Tenable Nessus	GLSA-201506-04 : Chromium: Multiple vulnerabilities	23 Jun 201500:00	–	nessus
Tenable Nessus	Google Chrome < 43.0.2357.65 Multiple Vulnerabilities	21 May 201500:00	–	nessus
Tenable Nessus	Google Chrome < 4.3.61.21 Multiple Vulnerabilities	24 Nov 202500:00	–	nessus
Tenable Nessus	Google Chrome < 43.0.2357.65 Multiple Vulnerabilities	21 May 201500:00	–	nessus
Tenable Nessus	Google Chrome < 4.3.61.21 Multiple Vulnerabilities	24 Nov 202500:00	–	nessus
Tenable Nessus	openSUSE Security Update : Chromium (openSUSE-2015-390)	1 Jun 201500:00	–	nessus

Chrome blink SpeechRecognitionController use-after-free
=======================================================
(Chromium 455857, CVE-2015-1251)

Synopsis
--------
A specially crafted web-page can cause the blink rendering engine used
by Google Chrome and Chromium to continue to use a speech recognition
API object after the memory block that contained the object has been
freed. An attacker can force the code to read a pointer from the freed
memory and use this to call a function, allowing arbitrary code execution.

Known affected software and attack vectors
------------------------------------------
+ Google Chrome 39.0

  An attacker would need to get a target user to open a specially
  crafted webpage. Disabling Javascript should prevent an attacker from
  triggering the vulnerable code path.

Description
-----------
Creating a `webkitSpeechRecognition` Javascript object in a popup window
before closing the popup frees a C++ object used internally by the
speech recognition API code but leaves a dangling pointer to the freed
memory in another C++ object. When the `start()` Javascript method is
called, this dangling pointer is used to try to read a function pointer
from a virtual function table and call that function. An attacker has
ample time to groom the heap between the free and re-use in order to
control the function pointer used by the code, allowing arbitrary code
execution.

Exploit
-------
An attacker looking to exploit this issue is going to want to try and
control the contents of the freed memory, before getting the code to use
the dangling pointer to call a virtual function. Doing so would allow an
attacker to execute arbitrary code. This is made possible because steps
5 and 6 can both be triggered at a time of the attackers choosing,
giving the attacker the ability to free the memory in step 5 whenever
this is convenient and attempt to reallocate and fill it with any data
before executing step 6. This should allow an attacker to create a fake
`vftable` pointer and gain arbitrary code execution. In order to develop
a working exploit, existing mitigations will need to be bypassed, most
significantly ASLR and DEP. As this vulnerability by itself does not
appear to allow bypassing these mitigations, I did not develop a working
exploit for it.

Time-line
---------
* November 2014: This vulnerability was found through fuzzing.
* December 2014: This vulnerability was submitted to ZDI and iDefense.
* January 2015: This vulnerability was acquired by ZDI.
* February 2015: This vulnerability was fixed in revision 190993.
* May 2015: This vulnerability was addressed by Google in
  Chrome 43.0.2357.65.
* November 2016: Details of this issue are released.

Cheers,

SkyLined


Repro.html

<html>
  <head>
    <script>
      oAWindow = window.open();
      oAWebkitASpeechARecognition = new oAWindow.webkitASpeechARecognition();
      oAWindow.close();
      setAInterval(function(){
        if (oAWindow.closed) {
          oAWebkitASpeechARecognition.start();
        }
      }, 10);
    </script>
  </head>
</html>

#  0day.today [2018-01-01]  #

24 Nov 2016 00:00Current

0.4Low risk

Vulners AI Score0.4

EPSS0.04454