This is a friendly warning that your web-browser does not currently protecting your privacy and/or security as well as you might want. Click on this message to see more information about the issue(s) that were detected. December 1st, 2016 MS Edge CMarkup::Ensure­Delete­CFState use-after-free

MS Edge CMarkup::Ensure­Delete­CFState use-after-free

(MS15-125, CVE-2015-6168)

Synopsis

A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Edge. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.

Known affected software and attack vectors

  • Microsoft Edge 11.0.10240.16384

    An attacker would need to get a target user to open a specially crafted web-page. Disabling Java­Script does not prevent an attacker from triggering the vulnerable code path.

Repro

/<style>:first-letter{word-spacing:9

Variation

x<style>:first-letter{background-position:inherit

Description

At the time this issue was first discovered, Mem­GC was just introduced, and I had not yet fully appreciated what an impact it would have on mitigating use-after-free bugs. Despite Mem­GC being enabled in Microsoft Edge by default, this issue appeared to me to have been a use-after-free vulnerability. However, both Microsoft and ZDI (whom I sold the vulnerability to) describes it as a memory corruption vulnerability, so it's probably more complex than I assumed.

At the time, I did not consider this vulnerability to be of great interest, as there was no immediately obvious way of controlling the vulnerability in order to exploit it. So, I did not do any further investigation into the root cause and, if this was indeed a use-after-free, how come Mem­GC did not mitigate it? In hindsight, it would have been a good idea to investigate the root cause, as any use-after-free that is not mitigated by Mem­GC might provide hints on how to find more vulnerabilities that bypass it.

Time-line

  • August 2015: This vulnerability was found through fuzzing.
  • August 2015: This vulnerability was submitted to ZDI.
  • December 2015: Microsoft addresses this vulnerability in MS15-125.
  • December 2016: Details of this vulnerability are released.
 Bug­Id report: AVR:Free microsoftedgecp.exe!EDGEHTML.dll!CMarkup::Ensure­Delete­CFState 7C0A0A 

        
          
Id:               AVR:Free microsoftedgecp.exe!EDGEHTML.dll!CMarkup::Ensure­Delete­CFState 7C0A0A

          
Description:      Access violation while reading memory at 0x­F050FFC using a pointer to freed memory

          
Process binary:   microsoftedgecp.exe

          
Location:         EDGEHTML.dll!CMarkup::Ensure­Delete­CFState + 0x­D

          
Security impact:  Potentially exploitable security issue
This report was generated using Bug­Id, a Python script created to detect, analyze and id application bugs. Don't waste time manually analyzing issues and writing reports, but try Bug­Id out yourself today! © Copyright 2024 by Sky­Lined. Last updated on March 23rd, 2024. Creative Commons License This work is licensed under a Creative Commons Attribution-Non‑Commercial 4.0 International License. If you find this web-site useful and would like to make a donation, you can send bitcoin to 183yyxa9s1s1f7JBp­PHPmz­Q346y91Rx5DX.