CVE-2015-6168
Description
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6153.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Microsoft Edge - CMarkup::EnsureDeleteCFState Use-After-Free (MS15-125)
Source: http://blog.skylined.nl/20161201001.html
Synopsis
A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Edge. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.
Known affected software and attack vectors
Microsoft Edge 11.0.10240.16384
An attacker would need to get a target user to open a specially crafted web-page. Disabling JavaScript does not prevent an attacker from triggering the vulnerable code path.
Repro:
/<style>:first-letter{word-spacing:9
Variation:
x<style>:first-letter{background-position:inherit
Description
At the time this issue was first discovered, MemGC was just introduced, and I had not yet fully appreciated what an impact it would have on mitigating use-after-free bugs. Despite MemGC being enabled in Microsoft Edge by default, this issue appeared to me to have been a use-after-free vulnerability. However, both Microsoft and ZDI (whom I sold the vulnerability to) describes it as a memory corruption vulnerability, so it's probably more complex than I assumed.
At the time, I did not consider this vulnerability to be of great interest, as there was no immediately obvious way of controlling the vulnerability in order to exploit it. So, I did not do any further investigation into the root cause and, if this was indeed a use-after-free, how come MemGC did not mitigate it? In hindsight, it would have been a good idea to investigate the root cause, as any use-after-free that is not mitigated by MemGC might provide hints on how to find more vulnerabilities that bypass it.
Time-line
August 2015: This vulnerability was found through fuzzing.
August 2015: This vulnerability was submitted to ZDI.
December 2015: Microsoft addresses this vulnerability in MS15-125.
December 2016: Details of this vulnerability are released.Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| microsoft | edge | - | |
References
- http://blog.skylined.nl/20161201001.html
- http://seclists.org/fulldisclosure/2016/Dec/4
- http://www.securitytracker.com/id/1034316
- http://www.zerodayinitiative.com/advisories/ZDI-15-583
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-125
- https://www.exploit-db.com/exploits/40878/
- http://blog.skylined.nl/20161201001.html
- http://seclists.org/fulldisclosure/2016/Dec/4
- http://www.securitytracker.com/id/1034316
- http://www.zerodayinitiative.com/advisories/ZDI-15-583
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-125
- https://www.exploit-db.com/exploits/40878/
CWEs
CWE-119
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.