(The fix and CVE number for this bug are not known)
A specially crafted web-page can cause Microsoft Internet Explorer 11 to free a memory block that contains information about an image. The code continues to use the data in freed memory block immediately after freeing it. It does not appear that there is enough time between the free and reuse to exploit this issue.
Microsoft Internet Explorer 11
<script> // This PoC attempts to exploit a memory disclosure bug in VBScript.
dll // See http://blog. skylined. nl/20161102001. html for details. var oDocumentFragment = document.createDocumentFragment(), oElement = document.createElement('x'); oDocumentFragment. appendChild(oElement); oElement. style. listStyleImage = "url(x)"; oDocumentFragment. removeChild(oElement); // This work by SkyLined is licensed under a Creative Commons // Attribution-Non-Commercial 4. 0 International License. </script>
listStyleImage property of an Element object causes MSIE to
allocate 0x4C bytes for an "image context" structure, which contains a
reference to the document object as well as a reference to the same
object as the document. When the element is removed from the document
(-fragment), this image context is freed on the next "draw". However, the code
continues to use the freed context almost immediately after it is freed.
I tried a few tricks to see if there was an easy way to reallocate the freed memory before the reuse, but was unable to find anything. I do not know if there is a way to cause further reuse of the freed memory later on in the code. Running the repro as-is without page heap does not appear to trigger crashes. It does not appear that there is enough time between the free and reuse to exploit this issue.
Unfortunately, my records of what happened after ZDI rejected the issue are patchy. It appears that I did not pursue reporting the issue anywhere else, but Microsoft does appear to have patched the issue, as I can no longer reproduce it.BugId report: MSHTML.
dll!CView:: CalculateImageImmunity Arbitrary~FB0 AVR(2B4083E3) description: Security: Attempt to read from unallocated arbitrary memory (@0x56F06FB0) in MSHTML. dll!CView:: CalculateImageImmunity note: The exception happens in the main process. Based on this information, this is expected to be a critical security issue!