576078 - (ZDI-CAN-852) FrameManager Remote Code Execution Vulnerability (ZDI-CAN-852) (-moz-column, position:absolute)

Reporter

Description

•

15 years ago

Attached file PoC — Details

ZDI-CAN-852: Mozilla Firefox FrameManager Remote Code Execution Vulnerability -- CVSS ---------------------------------------------------------------- 10, (AV:N/AC:L/Au:N/C:C/I:C/A:C) -- ABSTRACT ------------------------------------------------------------ TippingPoint has identified a vulnerability affecting the following products: Mozilla Firefox 3.6.x -- VULNERABILITY DETAILS ----------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of a particular CSS style when applied to a frame. If an element's contents are replaced without having a parent, the application will access memory that has been freed when trying to contact the parent container. This can lead to code execution under the context of the application. The bug is triggered when a root frame containing an absolutely positioned element is removed. Upon removal, the application will attempt to notify the parent frame to remove the target. This will cause the application to access the non-existent parent frame and attempt to fetch a method. Due to the parent frame being freed, this will trigger an exploitable condition. layout/base/nscssframeconstructor.cpp:7215 nsresult nsCSSFrameConstructor::ContentRemoved(nsIContent* aContainer, nsIContent* aChild, PRInt32 aIndexInContainer, RemoveFlags aFlags, PRBool* aDidReconstruct) { ... // Recover childFrame and parentFrame childFrame = mPresShell->GetPrimaryFrameFor(aChild); if (!childFrame || childFrame->GetContent() != aChild) { // XXXbz the GetContent() != aChild check is needed due to bug 135040. // Remove it once that's fixed. frameManager->ClearUndisplayedContentIn(aChild, aContainer); return NS_OK; } parentFrame = childFrame->GetParent(); parentType = parentFrame->GetType(); ... // See if the child frame is an out-of-flow if (childFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW) { nsPlaceholderFrame* placeholderFrame = frameManager->GetPlaceholderFrameFor(childFrame); NS_ASSERTION(placeholderFrame, "No placeholder for out-of-flow?"); // Now we remove the out-of-flow frame // XXX has to be done first for now: for floats, the block's line list // contains an array of pointers to the placeholder - we have to // remove the float first (which gets rid of the lines // reference to the placeholder and float) and then remove the // placeholder rv = frameManager->RemoveFrame(parentFrame, GetChildListNameFor(childFrame), childFrame); // Remove the placeholder frame first (XXX second for now) (so // that it doesn't retain a dangling pointer to memory) nsIFrame* placeholderParent = placeholderFrame->GetParent(); ::DeletingFrameSubtree(frameManager, placeholderFrame); rv |= frameManager->RemoveFrame(placeholderParent, nsnull, placeholderFrame); // XXX } else { // Notify the parent frame that it should delete the frame // check for a table caption which goes on an additional child list with a different parent nsIFrame* outerTableFrame; if (GetCaptionAdjustedParent(parentFrame, childFrame, &outerTableFrame)) { rv = frameManager->RemoveFrame(outerTableFrame, nsGkAtoms::captionList, childFrame); } else { rv = frameManager->RemoveFrame(parentFrame, nsnull, childFrame); } } When removing the frame, the application will call the method from already freed aParentFrame object. layout/base/nsFrameManager.cpp:719 nsresult nsFrameManager::RemoveFrame(nsIFrame* aParentFrame, nsIAtom* aListName, nsIFrame* aOldFrame) { PRBool wasDestroyingFrames = mIsDestroyingFrames; mIsDestroyingFrames = PR_TRUE; // In case the reflow doesn't invalidate anything since it just leaves // a gap where the old frame was, we invalidate it here. (This is // reasonably likely to happen when removing a last child in a way // that doesn't change the size of the parent.) // This has to sure to invalidate the entire overflow rect; this // is important in the presence of absolute positioning aOldFrame->Invalidate(aOldFrame->GetOverflowRect()); nsresult rv = aParentFrame->RemoveFrame(aListName, aOldFrame); // XXX mIsDestroyingFrames = wasDestroyingFrames; return rv; } Version(s) tested: Mozilla Firefox 3.6.3 Platform(s) tested: Windows XP SP3 -- CREDIT -------------------------------------------------------------- This vulnerability was discovered by: * wushi of team509