Exploit-DB #45778
Description: Microsoft Internet Explorer 11 - Null Pointer Dereference
Type: local
Platform: windows
Date: 2018-11-05
Author: LiquidWorm

Exploit:
# Exloit Title: Microsoft Internet Explorer 11 - Null Pointer Difference
# Author: Gjoko 'LiquidWorm' Krstic @zeroscience
# Date: 2018-11-03
# Vendor: Microsoft Corporation
# Product web page: https://www.microsoft.com
# Affected version: 11.345.17134.0 (Update Versions: 11.0.90 (KB4462949))
#                   11.1387.15063.0 (Update Versions: 11.0.90 (KB4462949))
#                   11.0.9600.18282 (Update Versions: 11.0.30 (KB3148198))
#                   11.0.9600.17843 (Update Versions: 11.0.20 (KB3058515))
# Tested on: Microsoft Windows 10 (EN) (64bit)
#            Microsoft Windows 7 SP1 (EN) (32/64bit)
# Affected module: mshtml.dll
# Affected functions: Tree::Notify_InvalidateDisplay
#                     CTreeNode::EnsureNoDependentLayoutFixup
#                     CMarkup::BuildDescendentsList
# References:
# Advisory ID: ZSL-2018-5499
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5499.php

# Desc: The crash is caused due to a NULL pointer dereference access violation inside the
# 'Tree::Notify_InvalidateDisplay' function while parsing malformed DOM elements. The issue
# was discovered using the Domato fuzzer.

# Microsoft Internet Explorer 11 Tree::Notify_InvalidateDisplay Null Pointer Dereference
# PoC: https://www.zeroscience.mk/codes/msie11_nullptr_fuzz-33.html.rar

# Trace:
################################################################################################

(e9c.142c): Access violation - code c0000005 (!!! second chance !!!)
eax=21b9efa0 ebx=21b9efac ecx=21b9efa0 edx=00000000 esi=00000000 edi=187a8fc4
eip=63f04e48 esp=08c39ab8 ebp=08c39ac4 iopl=0         nv up ei pl nz ac pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
MSHTML!CTreeNode::EnsureNoDependentLayoutFixup+0x43:
63f04e48 f[PII_REDACTED]0    test    dword ptr [esi],100h ds:002b:00000000=????????
0:007> k
 # ChildEBP RetAddr  
00 08c39ac4 63a52ddf MSHTML!CTreeNode::EnsureNoDependentLayoutFixup+0x43
01 08c39bd0 63a523c5 MSHTML!CMarkup::InsertElementInternalNoInclusions+0x1f3
02 08c39bf8 63a529d3 MSHTML!CMarkup::InsertElementInternal+0x3d
03 08c39c38 63a52a54 MSHTML!CDoc::InsertElement+0x9b
04 08c39cf8 63a3ca96 MSHTML!InsertDOMNodeHelper+0x154
05 08c39db8 63a3cc73 MSHTML!CElement::InsertBeforeHelper+0x22b
06 08c39ddc 63a3cff3 MSHTML!CElement::InsertBefore+0x2f
07 08c39e70 63a3cf06 MSHTML!CElement::Var_appendChild+0xb3
08 08c39ea0 6de5e6ee MSHTML!CFastDOM::CNode::Trampoline_appendChild+0x75
09 08c39f08 6de582cd jscript9!Js::JavascriptExternalFunction::ExternalFunctionThunk+0x101
0a 08c39f50 6df0833d jscript9!Js::JavascriptFunction::CallFunction<1>+0x91
0b 08c39f74 6dffc483 jscript9!Js::InterpreterStackFrame::OP_CallCommon<Js::OpLayoutDynamicProfile<Js::OpLayoutCallI> >+0x53
0c 08c39fa0 6dffc45c jscript9!Js::InterpreterStackFrame::OP_ProfileReturnTypeCallCommon<Js::OpLayoutDynamicProfile<Js::OpLayoutCallI> >+0x1c
0d 08c39fc0 6dffc428 jscript9!Js::InterpreterStackFrame::OP_ProfiledReturnTypeCallI<Js::OpLayoutCallI>+0x2a
0e 08c3a1b0 6dee5371 jscript9!Js::InterpreterStackFrame::Process+0x4e90
0f 08c3a1e8 6dee53d0 jscript9!Js::InterpreterStackFrame::OP_TryCatch+0x49
10 08c3a3d8 6de5c96b jscript9!Js::InterpreterStackFrame::Process+0x39dc
11 08c3bde4 0d8c0fd9 jscript9!Js::InterpreterStackFrame::InterpreterThunk<1>+0x1ce
WARNING: Frame IP not in any known module. Following frames may be wrong.
12 08c3bdf0 6de5c22d 0xd8c0fd9
13 08c3bfe8 6de5c96b jscript9!Js::InterpreterStackFrame::Process+0x1940
14 08c3c104 0d8c0fe1 jscript9!Js::InterpreterStackFrame::InterpreterThunk<1>+0x1ce
15 08c3c110 6de582cd 0xd8c0fe1
16 08c3c158 6de58a05 jscript9!Js::JavascriptFunction::CallFunction<1>+0x91
17 08c3c1cc 6de5893f jscript9!Js::JavascriptFunction::CallRootFunction+0xc1
18 08c3c214 6de588bf jscript9!ScriptSite::CallRootFunction+0x42
19 08c3c244 6de5d0f0 jscript9!ScriptSite::Execute+0x61
1a 08c3c2a0 6de5d02c jscript9!ScriptEngineBase::ExecuteInternal<0>+0xbb
1b 08c3c2b8 63a362a4 jscript9!ScriptEngineBase::Execute+0x1c
1c 08c3c374 63a3613e MSHTML!CListenerDispatch::InvokeVar+0x15a
1d 08c3c3a0 63a35e01 MSHTML!CListenerDispatch::Invoke+0x6d
1e 08c3c440 6398e7d2 MSHTML!CEventMgr::_InvokeListeners+0x1fe
1f 08c3c5b4 639d2863 MSHTML!CEventMgr::Dispatch+0x3bb
20 08c3c5dc 63eadc91 MSHTML!CEventMgr::DispatchEvent+0x90
21 08c3c5f0 63e94da9 MSHTML!CSVGElement::Fire_SVGLoad+0x46
22 08c3c608 63eadc43 MSHTML!CSVGSVGElement::Fire_SVGLoad+0x19
23 08c3c620 63dafdc1 MSHTML!CSVGElement::Fire_SVGLoad_Async_Handler+0x23
24 08c3c64c 6398f25c MSHTML!CAsyncEventQueue::DispatchAllEvents+0x41c3ea
25 08c3c6a0 771462fa MSHTML!GlobalWndProc+0x2d3
26 08c3c7bc 00a3ee48 user32!InternalCallWinProc+0x23
27 08c3c7c0 076bafe0 0xa3ee48
28 08c3c7c4 00000000 0x76bafe0


################################################################################################

(15e4.1634): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=22a98fa0 ecx=00000061 edx=000000c1 esi=22a96fac edi=0969c384
eip=63916681 esp=0969c1d8 ebp=0969c200 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
MSHTML!CMarkup::BuildDescendentsList+0x158:
63916681 81b[PII_REDACTED]09ffd63 cmp dword ptr [eax+328h],offset MSHTML!__vtguard (63fd9f60) ds:002b:00000328=????????
0:008> k
 # ChildEBP RetAddr  
00 0969c200 6384f86d MSHTML!CMarkup::BuildDescendentsList+0x158
01 0969c350 639b1597 MSHTML!CMarkup::Notify+0x17b
02 0969c3b8 639b1431 MSHTML!CMarkup::OnLoadStatusDone+0x14b
03 0969c3cc 639b078b MSHTML!CMarkup::OnLoadStatus+0xfa
04 0969c810 639aa322 MSHTML!CProgSink::DoUpdate+0x4c7
05 0969c81c 6382e541 MSHTML!CProgSink::OnMethodCall+0x12
06 0969c868 6382de4a MSHTML!GlobalWndOnMethodCall+0x16d
07 0969c8b8 771462fa MSHTML!GlobalWndProc+0x2e5
08 0969c8e4 77146d3a user32!InternalCallWinProc+0x23
09 0969c95c 771477c4 user32!UserCallWinProcCheckWow+0x109
0a 0969c9bc 7714788