$hell on Earth

Exploitation of CVE-2016-1859
To exploit this vulnerability, an initial heap spray is performed to establish optimal heap conditions. The
vulnerability is triggered and the 0x100-byte-sized GraphicsContext object is reclaimed. After reclaiming the
object, the write exploit primitive comes from the following code within WebCore::GraphicsContext::save()
function in Safari.
memcpy((void *)(v3 + v4 + 16), (char *)this + 20, 0x4Du);
A second heap spray is performed, which consists of strings followed by frame elements, that looks like
this:
[String][Frame] [String][Frame] [String][Frame] [String][Frame]
They utilize the write primitive to enlarge the string object’s length allowing the leak of a frame object’s
vtable. Again, they use this write primitive to change the string buffer pointer to achieve arbitrary memory
read.
To achieve code execution, they modify a vtable pointer of a frame object with the same write primitive.
Finally, they set up their ROP chain and divert execution to it.
CVE-2016-1859 Patch
To patch this vulnerability, Apple modified the code to grab width and height properties to ensure that
JavaScript code cannot delete the owner element.
10 | <strong>$hell</strong> on Earth: From Browser to System Compromise