This is a friendly warning that your web-browser does not currently protecting your privacy and/or security as
well as you might want. Click on this message to see more information about the issue(s) that were detected.
November 15th, 2016
MS Edge edgehtml CAttrArray::
(This fix and CVE number for this issue are not known)
A specially crafted web-page can cause Microsoft Edge to free memory used for
a CAttrArray object. The code continues to use the data in freed memory block
immediately after freeing it. It does not appear that there is enough time
between the free and reuse to exploit this issue.
Microsoft Edge 11.
An attacker would need to get a target user to open a specially crafted web-page. JavaScript is not necessarily required to trigger the issue.
<x style="
background-image: inherit;
text-decoration: line-through;
height: 0;
width: 0;
top: 0;
left: 0;
right: 0;
bottom: 0;
font: menu;">
Alternatively:
<body id=x style=margin:5 onload=x.When an element is created and style properties are added, these are stored in
a CAttrArray object. A new CAttrArray is able to store up to 8 properties.
If more properties need to be stored, the code will allocate memory for a
larger CAttrArray and copy the existing properties into this new object
before freeing the old memory. The code will then continue to use the freed
memory almost immediately. In the first repro, the "font" style property is the
ninth property and triggers this issue. In the second repro, the only property
of a CAttrArray is removed, at which point it is freed but no new object
is allocated. However, the code follows the same path and also reuses the freed
memory.
What little investigation I did appears to indicate that there is no way to reallocate the freed memory before its reuse. It is therefore probably not possible to exploit this issue that way. I did not investigate how the freed memory is used by the code exactly, and I did not look into other methods to exploit the issue. I did create a second repro that triggers the issue "on-demand" from Javascript but, as is to be expected, no Javascript is executed between the free and the re-use.
Repro.Below you can find an annotated disassembly for the CAttrArray::
function, which calls CAttrArray:: (in which the memory is freed) before
looping and re-using the memory. This loop shows there is very little time
between the two events in which to reallocate the memory and attempt to control
its contents. There also does not appear to be much this function can be made
to do if the memory could be controlled.
This work is licensed under a Creative Commons Attribution-Non‑Commercial 4.