-
-
[原创]IE漏洞CVE-2013-2551分析-附poc
-
发表于:
2013-6-14 19:22
7379
-
[原创]IE漏洞CVE-2013-2551分析-附poc
这个漏洞好多地方都说是UAF，但我调了一下感觉应该是一个整数溢出类型漏洞。下面是我的分析结果，贴出来和大家一起研究，欢迎拍砖。
POC来自于：
http://www.binvul.com/viewthread.php?tid=311&extra=page%3D1
感谢4B5F5F4B大牛，已经附在了附件中，解压密码为lvbluesky。
IE 漏洞 CVE-2013-2551 分析
By lvbluesky
这个漏洞好多地方都说是 UAF，但我调了一下感觉应该是一个整数溢出类型漏洞。下面是我的分析结果，贴出来和大家一起研究。POC 已经附在了附件中。
1. 调试环境
Windows xp sp2+IE8+Windbg
2. 漏洞综述
vgx.dll 在重设 COALineDashStyleArray length 大小时如果输入负数，会产生整数溢出，
该值被改写为一个很大的数，导致向 COALineDashStyleArray 的越界写入。可控制越界写
入的大小和内容，覆盖 COALineDashStyleArray 后面的函数指针。
3. 漏洞细节
程序在此处为 ID 为“shape”的 stroke 元素建立 dashstyle array：
021ad39c 0332c3c0 021ad3c8 00000020 00000101 vgx!GelHost::FAllocMemCore+0x8
021ad3c0 0332c545 00000004 00000008 ffffffff vgx!MsoFResizePx+0x69
021ad3dc 032ed0bb 00987de4 00000005 021ad494 vgx!MsoFGrowPx+0x18
021ad3f8 0335a068 00987de0 021ad42c 00000001 vgx!ORG::FAppendRange+0x39
021ad414 0335a0e2 021ad42c 00000004 0023dd34 vgx!VGPIE5array::FAddElement+0x42
021ad47c 0332cdfd 0023dd34 0000000f 009860a0 vgx!VGPIE5DwordArray::Text+0x60
021ad4a0 0332d379 0023dd34 00000000 0023dd34 vgx!GetArrayVal+0x86
021ad4b4 03332c51 00986080 0023dd34 000001cf vgx!ParseDashStyle+0x21
021ad4e8 033327be 00000001 ffffff88 021ad620 vgx!CVMLStroke::InternalLoad+0x100
021ad504 032e33b1 021ad618 021ad5a0 00000003 vgx!CVMLShapeIOProxy::Load+0x22
021ada5c 032e4331 02d44664 00000000 021ada98 vgx!CSimpleTag::Load+0x5e9
021ada6c 63800468 00986470 02d44664 00000000 vgx!CPTPropBag2<CSimpleTag>::Load+0x16
021ada98 635c1326 00206ac8 00000000 027e1790 mshtml!CPeerHolder::InitAttributes+0xa9
021adabc 635c120b 00000000 027e1790 00000000 mshtml!CPeerHolder::AttachPeer+0xb7
021adae4 637800d6 027e1790 00000000 00206ac8 mshtml!CPeerHolder::Create+0x59
021adafc 6377d8ca 00000000 027e1738 021afb80 mshtml!CPeerFactoryUrl::AttachPeer+0x29
021adb0c 6377dad2 00203c34 00000003 0020e7a8 mshtml!CDoc::AttachPeerUrl+0x31
021afb80 6376f580 0020e7a8 021afba8 00000000 mshtml!CDoc::AttachPeersCss+0x1d4
021afbcc 6376f4df 00000004 7c8092ac 0073fd3c mshtml!CElement::ProcessPeerTask+0x181
021afbe8 635c075d 0020bab0 00000000 021a0013 mshtml!CMarkup::ProcessPeerTasks+0xe9
vgx!GelHost::FAllocMemCore:
032e56d8 8bff mov edi,edi
032e56da 55 push ebp
032e56db 8bec mov ebp,esp
032e56dd ff750c push dword ptr [ebp+0Ch]
032e56e0 ff1534102c03 call dword ptr [vgx!_imp__malloc (032c1034)]
vgx!GelHost::FAllocMemCore+0x8:
032e56e0 call dword ptr [vgx!_imp__malloc (032c1034)] ds:0023:032c1034={msvcrt!malloc
(77bfc407)}
0:001> dd esp
021ad398 00000020 021ad3c0 0332c3c0 021ad3c8
0:001> p
eax=00987d90 ebx=00000005 ecx=00000000 edx=77c31aa0 esi=00987de4 edi=0000ffff
eip=032e56e6 esp=021ad398 ebp=021ad39c iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
vgx!GelHost::FAllocMemCore+0xe:
032e56e6 59 pop ecx
eax=00987d90 ebx=00000005 ecx=00987dc0 edx=77c31aa0 esi=00987de4 edi=0000ffff
eip=0332c485 esp=021ad3b0 ebp=021ad3c0 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
vgx!MsoFResizePx+0x12e:
0332c485 89460c mov dword ptr [esi+0Ch],eax ds:0023:00987df0=00987dc0
0:001> u poi(esi-4)
vgx!ORG::`vftable':
ChildEBP RetAddr Args to Child
021a9e1c 0332a5be 00988108 021a9e5c 0332a609 vgx!CSafePtr::CSafePtr+0x14
021a9e28 0332a609 021a9e5c 021a9e44 03325f1e vgx!CObjectSafe::GetSafePtr+0x2e
021a9e34 03325f1e 00988108 00988360 021a9e54 vgx!CSafeRef::CSafeRef+0x17
021a9e44 03326852 009880d0 00988360 021a9e74
vgx!CTreeRefTo<CVMLShape>::CTreeRefTo<CVMLShape>+0x1e
021a9e54 033272b5 00000000 00000000 00000000 vgx!CVMLShape::SetSibling+0x13
021a9e74 033284be 009880d0 00000000 00986550 vgx!CVMLPage::AddToplevel+0x36
021a9e9c 03329c45 00986550 00000000 0000003d vgx!CVMLShape::Init+0x319
021a9ebc 033321ae 0000003d 00000000 00988170 vgx!CVMLPage::FAddShape+0xd2
021a9f00 032e2f63 021a9f44 0000003d 00988170 vgx!CVMLPage::CreateContainer+0x203
021aa454 032e5481 02d0a0ec 00000000 00000000 vgx!CSimpleTag::Load+0x19c
021aa46c 032e5540 02d0a0ec 00000000 021aa4a8 vgx!CParserTag::Load+0x14
021aa47c 63800468 00988bb0 02d0a0ec 00000000 vgx!CPTPropBag2<CParserTag>::Load+0x16
021aa4a8 635c1326 00207128 00000000 027e1790 mshtml!CPeerHolder::InitAttributes+0xa9
021aa4cc 635c120b 00000000 027e1790 00000000 mshtml!CPeerHolder::AttachPeer+0xb7
021aa4f4 637800d6 027e1790 00000000 00207128 mshtml!CPeerHolder::Create+0x59
021aa50c 6377d8ca 00000000 027e1738 021ac590 mshtml!CPeerFactoryUrl::AttachPeer+0x29
021aa51c 6377dad2 0023d544 00000003 0020e6e8 mshtml!CDoc::AttachPeerUrl+0x31
021ac590 6376f580 0020e6e8 021ac5b8 00000000 mshtml!CDoc::AttachPeersCss+0x1d4
021ac5dc 6376f4df 00000004 02d79d10 0020e568 mshtml!CElement::ProcessPeerTask+0x181
021ac5f8 63664103 0020bab0 00000000 02d79d10 mshtml!CMarkup::ProcessPeerTasks+0xe9
eax=00988090 ebx=00986568 ecx=00988108 edx=77c31aa0 esi=00988108 edi=00986550
eip=0332a519 esp=021a9e1c ebp=021a9e1c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
vgx!CSafePtr::CSafePtr+0xe:
0332a519 c7004ccd2d03 mov dword ptr [eax],offset vgx!CSafePtr::`vftable' (032dcd4c)
ds:0023:00988090=????????
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
