This is a friendly warning that your web-browser does not currently protecting your privacy and/or security as well as you might want. Click on this message to see more information about the issue(s) that were detected. March 15th, 2016 MS Edge Tree::ANode::Is­In­Tree use-after-free (Mem­GC) & Abandonment

MS Edge Tree::ANode::Is­In­Tree use-after-free (Mem­GC) & Abandonment

A specially crafted Javascript inside an HTML page can trigger a use-after-free bug in Tree::ANode::Is­In­Tree or a breakpoint in Abandonment::Induce­Abandonment in Microsoft Edge. The use-after-free bug is mitigated by Mem­GC: if Mem­GC is enabled (which it is by default) the memory is never freed. This effectively prevents exploitation of the issue. The Abandonment appears to be triggered by a stack exhaustion bug; the Javascript creates a loop where an event handler triggers a new event, which in turn triggers the event handler, etc.. This consumes a stack space until there is no more stack available. MSIE does appear to be able to handle such a situation gracefully under certain conditions, but not all. It is easy to avoid those conditions to force triggering the Abandonment.

The interesting thing is that this indicates that the assumption that "hitting Abandonment means a bug is not a security issue" may not be correct in all cases.

Known affected software, attack vectors and mitigations

  • Microsoft Edge 11.0.10240.16384-16724 (earlier versions may also be affected)

    An attacker would need to get a target user to open a specially crafted web page. Disabling Javascript should prevent an attacker from triggering the vulnerable code path.

Use-after-free

The reuse of freed memory happens in Tree::ANode::Is­In­Tree, and as mentioned earlier, it is mitigated by Mem­GC by default. This mitigation is considered sufficient to consider this not a security issue as explained by SWIAT in Triaging the exploitability of IE/Edge crashes.

Abandonment

The original repro that was created during fuzzing triggered the use-after-free bug some of the time, but also had a decent chance of trigger the Abandonment. From what I've heard through the grapevine, Microsoft Internet Explorer developers consider hitting an Abandonment as an indication that a bug is not a security issue: it's considered a sign that the code has detected an error before it can be exploited. This particular repro appears to contradict that view to a degree; while this use-after-free is not exploitable in real-life because of Mem­GC, the fact that the original repro sometimes hit an Abandonment that appears to be caused by stack exhaustion did nothing to prevent that same repro from sometimes triggering a use-after-free when Mem­GC is disabled. In other words: triggering Abandonment is not a reliable indication that a repro is not able to a trigger a security issue.

Obviously, it is also not true that triggering Abandonment does mean you have found a security issue. However, it may be wise to repeatedly test a repro that has triggered Abandonment in order to see if it can also trigger other exceptions. Another potentially good idea is to use such a repro as input for a fuzzer; slight modifications to the repro may modify the code path in such a way that the chance of hitting another exception increases. Unfortunately, I have not encountered this situation often enough to have sufficient data to offer any guidelines on how much effort to put into this.

Analysis

In this case, I used Edge­Dbg together with Bug­Id to repeatedly run the original repro until I had triggered both the use-after-free and Abandonment. This can be done by running the Edge­Bug­Id.cmd script provided with Edge­Dbg. I added the command line switch --Bug­Id.b­Save­Dump=true after the URL, which will cause Bug­Id to write a memory dump whenever it detects a bug. This provided me with Bug­Id reports and memory dumps for both issues. I then loaded the memory dumps in a debugger to analyze them and found out the Abandonment was probably triggered by a loop in the event handler. This allowed me to tweak the repro until it was able to trigger one or the other on demand.

 Repro.xhtml <!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml"> <script><![CDATA[ // Choose what bug you want to trigger. If both are set, abandonment will be // triggered. If neither is set, no bug will be triggered. var b­Trigger­Use­After­Free = true, b­Trigger­Abandonment = false; if (window === top) { document.document­Element.append­Child(document.create­Element("iframe")).src = "?"; } else { var u­Event­Counter = 0; document.add­Event­Listener("DOMNode­Removed",function(o­Event) { if (b­Trigger­Abandonment || ++u­Event­Counter == 2) { document.document­Element.text­Content = "x"; } else if (b­Trigger­Use­After­Free) { document.document­Element.offset­Top; }; }, true); onload = function() { do { document.document­Element.text­Content = ""; } while (b­Trigger­Abandonment); }; }; ]]></script> Bug­Id report: AVR:Free 41b.646 @ microsoftedgecp.exe!edgehtml.dll!Tree::ANode::Is­In­Tree 

          
Id:                      AVR:Free 41b.646

          
Description:             Access violation while reading freed memory at 0x6F084FBF50

          
Location:                microsoftedgecp.exe!edgehtml.dll!Tree::ANode::Is­In­Tree

          
Security impact:    Potentially exploitable security issue
This report was generated using Bug­Id, a Python script created to detect, analyze and id application bugs. Don't waste time manually analyzing issues and writing reports, but try Bug­Id out yourself today! Bug­Id report: Breakpoint 2e5.efc @ microsoftedgecp.exe!edgehtml.dll!Abandonment::Check­HRESULTStrict 

          
Id:                      Breakpoint 2e5.efc

          
Description:             Break instruction exception (code 0x80000003)

          
Location:                microsoftedgecp.exe!edgehtml.dll!Abandonment::Check­HRESULTStrict

          
Security impact:    None
This report was generated using Bug­Id, a Python script created to detect, analyze and id application bugs. Don't waste time manually analyzing issues and writing reports, but try Bug­Id out yourself today! © Copyright 2024 by Sky­Lined. Last updated on March 23rd, 2024. Creative Commons License This work is licensed under a Creative Commons Attribution-Non‑Commercial 4.0 International License. If you find this web-site useful and would like to make a donation, you can send bitcoin to 183yyxa9s1s1f7JBp­PHPmz­Q346y91Rx5DX.