Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 600: Line 600:


==== Analysis ====
==== Analysis ====
* [https://nvd.nist.gov/vuln/detail/CVE-2016-1859 NVD description of CVE-2016-1859 (May 5, 2016)]
* [https://www.zerodayinitiative.com/advisories/ZDI-16-352/ ZDI advisory for CVE-2016-1859 (2016-05-20)]
* [https://www.zerodayinitiative.com/advisories/ZDI-16-352/ ZDI advisory for CVE-2016-1859 (May 20, 2016)]
* [https://nvd.nist.gov/vuln/detail/CVE-2016-1859 NVD description of CVE-2016-1859 (2016-05-20)]
* [https://www.blackhat.com/docs/us-16/materials/us-16-Molinyawe-Shell-On-Earth-From-Browser-To-System-Compromise-wp.pdf Writeup by Matt Molinyawe, Abdul-Aziz Hariri, and Jasiel Spelman (Trend Micro) (August 1, 2016)]
* [https://www.blackhat.com/docs/us-16/materials/us-16-Molinyawe-Shell-On-Earth-From-Browser-To-System-Compromise-wp.pdf Writeup by Matt Molinyawe, Abdul-Aziz Hariri, and Jasiel Spelman (Trend Micro) (2016)]
* [http://arayz.github.io/933ky/A-general-attack-model-of-UAF-on-browser/ Writeup by Arayz (Wang Ao) (March 31, 2017)]
* [http://arayz.github.io/933ky/A-general-attack-model-of-UAF-on-browser/ Writeup by Arayz (Wang Ao) (March 31, 2017)]
* [https://daehee87.github.io/data/ruma.pdf On the Analysis of Byte-Granularity Heap Randomization (October 24, 2019)]


==== Bug Description ====
==== Bug Description ====
The specific flaw exists within the handling of GraphicsContext objects. By manipulating a document's elements an attacker can force this object in memory to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process.
The specific flaw exists within the handling of GraphicsContext objects. By manipulating a document's elements an attacker can force this object in memory to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process.
CVE-2016-1859 is a use-after-free vulnerability that existed in the Safari web browser. A GraphicsContext object is used in the setPlatformTextDrawingMode function after it has been freed. The successful triggering of the use-after-free vulnerability itself does not allow the attacker to directly change the control flow or disclose arbitrary memory contents. However, the use-after-free yields an arbitrary-memory-write primitive by hijacking a destination pointer that will be used for the memcpy function. Once the arbitrary-memory-write primitive is achieved, the attacker sprays the heap with string objects to achieve the arbitrary-memory-read primitive. Relying on the pointer width heap alignment, the attacker can accurately predict the exact address of one of the string objects among the heap spray and pinpoint the address of member variable. At this point, the attacker can overwrite the length member variable of a string object and partially disclose the out-of-bound heap area exceeding the buffer address of the string. The partial disclosure of the heap memory allows the attacker to extend the information leak step-by-step and ultimately allows full chaining of ROP, which leads to arbitrary code execution.


==== Exploit Implementation ====
==== Exploit Implementation ====
* PoC publicly available
* PoC publicly available
* No full exploit publicly available but exploitation description is detailed
* No full exploit publicly available


==== Patched ====
==== Patched ====
Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps4/Vulnerabilities"