Microsoft MS09-002 Vulnerability Analysis Report

From: Old Xie's blog

The CFunctionPointer function of Internet Explorer does not properly process document objects. If an object is appended with a specific sequence and deleted, memory corruption can be triggered. Attackers can construct code in a special sequence to trigger memory corruption and use specially crafted buffers to execute arbitrary code with the permissions of the currently logged-on user.

This vulnerability exists in mshtml. dll. The CFunctionPointer object does not properly reference the Document Object (TAG object or other) in its constructor, which may be released before the CFunctionPointer object is released, CFunctionPointer will continue to use the destroyed document object.

This is the constructor of CFunctionPointer:
Public: _ thiscall CFunctionPointer: CFunctionPointer (class CBase *, long)
. Text: 775E7BE9 mov edi, edi
. Text: 775E7BEB push ebp
. Text: 775E7BEC mov ebp, esp
. Text: 775E7BEE push esi
. Text: 775E7BEF mov esi, ecx
. Text: 775E7BF1 call ?? 0CBase @ QAE @ XZ; CBase: CBase (void)
. Text: 775E7BF6 mov ecx, [ebp + pOwner]
. Text: 775E7BF9 test ecx, ecx
. Text: 775E7BFB mov eax, [ebp + pISecurityContext]
. Text: 775E7BFE mov dword ptr [esi], offset ?? _ 7CFunctionPointer @ 6B @; const CFunctionPointer: 'vftable'
. Text: 775E7C04 mov [esi + 10 h], ecx // sets the associated Document Object

When setting a document object, the CFunctionPointer constructor simply assigns it to [edi + 10 h] without referencing it (AddRef ).

In other functions of cfunpoinpointer, the object pointer of this association document is almost used. For example, CFunctionPointer: PrivateAddRef of IUnknown: Release is implemented, and CFunctionPointer: privaterelter of IUnknown is implemented.

This is the CFunctionPointer: PrivateAddRef function:
Virtual unsigned long CFunctionPointer: PrivateAddRef (void)
. Text: 775E7A21 arg_0 = dword ptr 8
. Text: 775E7A21 mov edi, edi
. Text: 775E7A23 push ebp
. Text: 775E7A24 mov ebp, esp
. Text: 775E7A26 push esi
. Text: 775E7A27 mov esi, [ebp + arg_0]; this
. Text: 775E7A2A mov eax, [esi + 10 h]; get Document Object Pointer
. Text: 775E7A2D test eax, eax
. Text: 775E7A2F jz short loc_775E7A3D
. Text: 775E7A31 cmp dword ptr [esi + 4], 0
. Text: 775E7A35 jz short loc_775E7A3D
. Text: 775E7A37 mov ecx, [eax]; obtain the first DWORD, that is, the virtual table pointer.
. Text: 775E7A39 push eax
. Text: 775E7A3A call dword ptr [ecx + 4]; call the function at the + 4 position, that is, AddRef

For example, in CFunctionPointer: PrivateAddRef, if the document object has been destroyed, an unpredictable virtual table pointer will be obtained. After executing call dword ptr [ecx + 4, it will jump to an unpredictable address for execution, which will usually cause IE to crash.

Attackers can take specific steps to release the associated documentation object of the CFunctionPointer object before the CFunctio nPointer object is released, and then reference the CFunctionPointer object, the released document object is reused.

Attackers can set the data in the original memory location of the released document object in a special way (the incorrect virtual table can be constructed ), this vulnerability is extended to be exploited to execute arbitrary code.