https://pwnwiki.com/index.php?action=history&feed=atom&title=CVE-2014-4140_Internet_Explorer_ASLR%E7%B9%9E%E9%81%8E%E6%BC%8F%E6%B4%9E CVE-2014-4140 Internet Explorer ASLR繞過漏洞 - Revision history 2026-04-13T18:17:49Z Revision history for this page on the wiki MediaWiki 1.35.1 https://pwnwiki.com/index.php?title=CVE-2014-4140_Internet_Explorer_ASLR%E7%B9%9E%E9%81%8E%E6%BC%8F%E6%B4%9E&diff=1083&oldid=prev Pwnwiki: Created page with "==INFO== Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vu..." 2021-04-07T03:41:13Z <p>Created page with &quot;==INFO== Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka &quot;Internet Explorer ASLR Bypass Vu...&quot;</p> <p><b>New page</b></p><div>==INFO==<br /> Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka &quot;Internet Explorer ASLR Bypass Vulnerability.&quot;<br /> <br /> ==Note==<br /> &lt;pre&gt;<br /> Some rough notes<br /> <br /> 0:007&gt; u<br /> MSHTML!CHtmRootParseCtx::AddText+0x104:<br /> 6efff0a5 8b8e88000000 mov ecx,dword ptr [esi+88h]<br /> 6efff0ab 898d70ffffff mov dword ptr [ebp-90h],ecx<br /> 6efff0b1 8945ac mov dword ptr [ebp-54h],eax<br /> 6efff0b4 8b5118 mov edx,dword ptr [ecx+18h]<br /> 6efff0b7 8bca mov ecx,edx<br /> 6efff0b9 83e103 and ecx,3<br /> 6efff0bc 83f902 cmp ecx,2<br /> 6efff0bf 0f8531050000 jne MSHTML!CHtmRootParseCtx::AddText+0x2d7 (6efff5f6)<br /> 0:007&gt; g<br /> Breakpoint 2 hit<br /> eax=0dc8aff0 ebx=00000006 ecx=0600005a edx=0e842fd0 esi=0eb34f18 edi=00000006<br /> eip=6efff0a5 esp=09bcbdd0 ebp=09bcbe84 iopl=0 nv up ei pl nz na pe nc<br /> cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206<br /> MSHTML!CHtmRootParseCtx::AddText+0x104:<br /> 6efff0a5 8b8e88000000 mov ecx,dword ptr [esi+88h] ds:002b:0eb34fa0=0e842fd0<br /> 0:007&gt; g<br /> Breakpoint 2 hit<br /> eax=0eb2c800 ebx=00000001 ecx=0600005b edx=0e842fd0 esi=0eb34f18 edi=00000001<br /> eip=6efff0a5 esp=09bcbdd8 ebp=09bcbe8c iopl=0 nv up ei pl nz na po nc<br /> cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202<br /> MSHTML!CHtmRootParseCtx::AddText+0x104:<br /> 6efff0a5 8b8e88000000 mov ecx,dword ptr [esi+88h] ds:002b:0eb34fa0=0e842fd0<br /> 0:007&gt; g<br /> Breakpoint 2 hit<br /> eax=0600005c ebx=0e842fd0 ecx=00000001 edx=09bcbcd6 esi=0eb34f18 edi=00000000<br /> eip=6f01ac7a esp=09bcbb78 ebp=09bcbc2c iopl=0 nv up ei pl nz na pe nc<br /> cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206<br /> MSHTML!CHtmRootParseCtx::AddText+0x969:<br /> 6f01ac7a 8b8688000000 mov eax,dword ptr [esi+88h] ds:002b:0eb34fa0=0e842fd0<br /> 0:007&gt; g<br /> Breakpoint 1 hit<br /> eax=00000001 ebx=00000000 ecx=77c338aa edx=03c31078 esi=0e9def40 edi=0e842fd0<br /> eip=6ef7c11c esp=09bcc698 ebp=09bcc6a0 iopl=0 nv up ei pl nz na po nc<br /> cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202<br /> MSHTML!CTreeDataPos::SetTextData+0x1c:<br /> 6ef7c11c 5f pop edi<br /> 0:007&gt; dd e842ff0<br /> 0e842ff0 0e9def40 0600005c 00000000 d0d0d0d0<br /> 0e843000 ???????? ???????? ???????? ????????<br /> 0e843010 ???????? ???????? ???????? ????????<br /> 0e843020 ???????? ???????? ???????? ????????<br /> 0e843030 ???????? ???????? ???????? ????????<br /> 0e843040 ???????? ???????? ???????? ????????<br /> 0e843050 ???????? ???????? ???????? ????????<br /> 0e843060 ???????? ???????? ???????? ????????<br /> 0:007&gt; g<br /> SetContext failed, 0x80070005<br /> MachineInfo::SetContext failed - Thread: 0C74BC20 Handle: 2f8 Id: b58 - Error == 0x80070005<br /> SetContext failed, 0x80070005<br /> MachineInfo::SetContext failed - Thread: 0C74B520 Handle: 810 Id: 7b0 - Error == 0x80070005<br /> SetContext failed, 0x80070005<br /> MachineInfo::SetContext failed - Thread: 0C74B420 Handle: 8c8 Id: 604 - Error == 0x80070005<br /> (a04.9b8): Unknown exception - code 80010108 (first chance)<br /> (a04.8f4): Access violation - code c0000005 (first chance)<br /> First chance exceptions are reported before any exception handling.<br /> This exception may be expected and handled.<br /> eax=0000000a ebx=0bd78ffa ecx=0e9deffe edx=00000000 esi=0bd78fb2 edi=0e9df000<br /> eip=6f5a1f54 esp=09bcc6bc ebp=09bcc6d0 iopl=0 nv up ei ng nz ac po cy<br /> cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010293<br /> MSHTML!CTreeDataPos::GetPlainText+0x536828:<br /> 6f5a1f54 66394102 cmp word ptr [ecx+2],ax ds:002b:0e9df000=????<br /> 0:007&gt; dd e842ff0<br /> 0e842ff0 0e9def40 0600005c 00000000 d0d0d0d0<br /> 0e843000 ???????? ???????? ???????? ????????<br /> 0e843010 ???????? ???????? ???????? ????????<br /> 0e843020 ???????? ???????? ???????? ????????<br /> 0e843030 ???????? ???????? ???????? ????????<br /> 0e843040 ???????? ???????? ???????? ????????<br /> 0e843050 ???????? ???????? ???????? ????????<br /> 0e843060 ???????? ???????? ???????? ????????<br /> 0:007&gt; dd poi(e842ff0)<br /> 0e9def40 00000001 0000005c 0062003c 00730061<br /> 0e9def50 00660065 006e006f 00200074 00740073<br /> 0e9def60 006c0079 003d0065 00640022 00730069<br /> 0e9def70 006c0070 00790061 0066003a 006f006c<br /> 0e9def80 00740061 0020003a 00690072 00680067<br /> 0e9def90 003b0074 006f0062 00740074 006d006f<br /> 0e9defa0 0020003a 0031002d 00650030 003b006d<br /> 0e9defb0 006d0065 00740070 002d0079 00650063<br /> 0:007&gt; u mshtml + 0x2af33f<br /> MSHTML!CHtmRootParseCtx::AddText+0x460:<br /> 6efff33f 8bf8 mov edi,eax<br /> 6efff341 85ff test edi,edi<br /> 6efff343 0f849e805500 je MSHTML!CHtmRootParseCtx::AddText+0x558452 (6f5573e7)<br /> 6efff349 8b4718 mov eax,dword ptr [edi+18h]<br /> 6efff34c 810fc0000000 or dword ptr [edi],0C0h<br /> 6efff352 83e037 and eax,37h<br /> 6efff355 83c840 or eax,40h<br /> 6efff358 c7471c00000000 mov dword ptr [edi+1Ch],0<br /> <br /> <br /> MSHTML!CTreeDataPos::GetPlainText+0x536828:<br /> 709b1f54 66394102 cmp word ptr [ecx+2],ax ds:002b:0ffa0000=????<br /> <br /> bp mshtml + 0x31b799<br /> pointer to CTextArea dd poi(poi(poi(ecx+1c)+0c+14)+20)=5c<br /> dds poi(poi(poi(9b3c58c)+14)+20)<br /> <br /> 0:007&gt; k<br /> ChildEBP RetAddr <br /> 096fc4a8 6e17a317 MSHTML!CTreeDataPos::GetPlainText<br /> 096fc4dc 6e08f968 MSHTML!CElement::GetPlainTextInternal+0xda<br /> 096fc514 6e18fea7 MSHTML!CElement::GetPlainTextInScope+0x41<br /> 096fc53c 6e18fe47 MSHTML!CRichtext::Notify+0x81<br /> 096fc550 6ddd1a09 MSHTML!CTextArea::Notify+0x12<br /> 096fc5d0 6df6be6f MSHTML!CHtmParseBase::Execute+0xee<br /> 096fc6f4 6dde7ec9 MSHTML!CHtmPost::Exec+0x474<br /> 096fc70c 6dde7e4d MSHTML!CHtmPost::Run+0x1c<br /> 096fc72c 6dde8daf MSHTML!PostManExecute+0x61<br /> 096fc740 6dde8d10 MSHTML!PostManResume+0x7b<br /> 096fc770 6ddf2e3c MSHTML!CHtmPost::OnDwnChanCallback+0x38<br /> 096fc780 6dd40d01 MSHTML!CDwnChan::OnMethodCall+0x19<br /> 096fc7c4 6dd29a5a MSHTML!GlobalWndOnMethodCall+0x12c<br /> 096fc810 75e362fa MSHTML!GlobalWndProc+0x115<br /> 096fc83c 75e36d3a user32!InternalCallWinProc+0x23<br /> 096fc8b4 75e377c4 user32!UserCallWinProcCheckWow+0x109<br /> 096fc914 75e3788a user32!DispatchMessageWorker+0x3bc<br /> 096fc924 7148bdfc user32!DispatchMessageW+0xf<br /> 096ffae4 715d602f IEFRAME!CTabWindow::_TabWindowThreadProc+0x445<br /> 096ffb9c 7649d14c IEFRAME!LCIETab_ThreadProc+0x31c<br /> 096ffbac 72ef31cc iertutil!_IsoThreadProc_WrapperToReleaseScope+0xe<br /> 096ffbd8 7696338a IEShims!NS_CreateThread::DesktopIE_ThreadProc+0x71<br /> 096ffbe4 77c39f72 kernel32!BaseThreadInitThunk+0xe<br /> 096ffc24 77c39f45 ntdll!__RtlUserThreadStart+0x70<br /> 096ffc3c 00000000 ntdll!_RtlUserThreadStart+0x1b<br /> <br /> edi comes from...<br /> 0:007&gt; !heap -p -a edi<br /> address 0e714fd0 found in<br /> _DPH_HEAP_ROOT @ 2c61000<br /> in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize)<br /> e611340: e714fd0 2c - e714000 2000<br /> 72a78e89 verifier!AVrfDebugPageHeapAllocate+0x00000229<br /> 77cd0d96 ntdll!RtlDebugAllocateHeap+0x00000030<br /> 77c8af0d ntdll!RtlpAllocateHeap+0x000000c4<br /> 77c33cfe ntdll!RtlAllocateHeap+0x0000023a<br /> 6e5af33f MSHTML!CHtmRootParseCtx::AddText+0x00000460<br /> 6e5aef8b MSHTML!CHtmRootParseCtxRouter::AddText+0x0000001d<br /> 6e5333f0 MSHTML!CInsertionMode::HandleCharacterToken+0x0000005b<br /> 6e5347b6 MSHTML!CHtml5Tokenizer::RCDATALessThanSign_StateHandler+0x000000c7<br /> 6e5b4455 MSHTML!CHtml5Tokenizer::ParseBuffer+0x0000023c<br /> 6e5b4be7 MSHTML!CHtml5Parse::ParseToken+0x0000010e<br /> 6e5ac7c9 MSHTML!CHtmPost::ProcessTokens+0x000001d2<br /> 6e5abbbf MSHTML!CHtmPost::Exec+0x0000017f<br /> 6e427ec9 MSHTML!CHtmPost::Run+0x0000001c<br /> 6e427e4d MSHTML!PostManExecute+0x00000061<br /> 6e428daf MSHTML!PostManResume+0x0000007b<br /> 6e432e3c MSHTML!CDwnChan::OnMethodCall+0x00000019<br /> 6e380d01 MSHTML!GlobalWndOnMethodCall+0x0000012c<br /> 6e369a5a MSHTML!GlobalWndProc+0x00000115<br /> 75e362fa user32!InternalCallWinProc+0x00000023<br /> 75e36d3a user32!UserCallWinProcCheckWow+0x00000109<br /> 75e377c4 user32!DispatchMessageWorker+0x000003bc<br /> 75e3788a user32!DispatchMessageW+0x0000000f<br /> 7148bdfc IEFRAME!CTabWindow::_TabWindowThreadProc+0x00000445<br /> 715d602f IEFRAME!LCIETab_ThreadProc+0x0000031c<br /> 7649d14c iertutil!_IsoThreadProc_WrapperToReleaseScope+0x0000000e<br /> 72ef31cc IEShims!NS_CreateThread::DesktopIE_ThreadProc+0x00000071<br /> 7696338a kernel32!BaseThreadInitThunk+0x0000000e<br /> 77c39f72 ntdll!__RtlUserThreadStart+0x00000070<br /> 77c39f45 ntdll!_RtlUserThreadStart+0x0000001b<br /> &lt;/pre&gt;<br /> <br /> <br /> ==textarea_OOB_array_read_notes==<br /> &lt;pre&gt;<br /> MSHTML!CTreeDataPos::GetPlainText+0x536828:<br /> 709b1f54 66394102 cmp word ptr [ecx+2],ax ds:002b:0ffa0000=????<br /> <br /> bp mshtml + 0x31b799<br /> pointer to CTextArea dd poi(poi(poi(ecx+1c)+0c+14)+20)=5c<br /> dds poi(poi(poi(9b3c58c)+14)+20)<br /> <br /> 0:007&gt; k<br /> ChildEBP RetAddr <br /> 096fc4a8 6e17a317 MSHTML!CTreeDataPos::GetPlainText<br /> 096fc4dc 6e08f968 MSHTML!CElement::GetPlainTextInternal+0xda<br /> 096fc514 6e18fea7 MSHTML!CElement::GetPlainTextInScope+0x41<br /> 096fc53c 6e18fe47 MSHTML!CRichtext::Notify+0x81<br /> 096fc550 6ddd1a09 MSHTML!CTextArea::Notify+0x12<br /> 096fc5d0 6df6be6f MSHTML!CHtmParseBase::Execute+0xee<br /> 096fc6f4 6dde7ec9 MSHTML!CHtmPost::Exec+0x474<br /> 096fc70c 6dde7e4d MSHTML!CHtmPost::Run+0x1c<br /> 096fc72c 6dde8daf MSHTML!PostManExecute+0x61<br /> 096fc740 6dde8d10 MSHTML!PostManResume+0x7b<br /> 096fc770 6ddf2e3c MSHTML!CHtmPost::OnDwnChanCallback+0x38<br /> 096fc780 6dd40d01 MSHTML!CDwnChan::OnMethodCall+0x19<br /> 096fc7c4 6dd29a5a MSHTML!GlobalWndOnMethodCall+0x12c<br /> 096fc810 75e362fa MSHTML!GlobalWndProc+0x115<br /> 096fc83c 75e36d3a user32!InternalCallWinProc+0x23<br /> 096fc8b4 75e377c4 user32!UserCallWinProcCheckWow+0x109<br /> 096fc914 75e3788a user32!DispatchMessageWorker+0x3bc<br /> 096fc924 7148bdfc user32!DispatchMessageW+0xf<br /> 096ffae4 715d602f IEFRAME!CTabWindow::_TabWindowThreadProc+0x445<br /> 096ffb9c 7649d14c IEFRAME!LCIETab_ThreadProc+0x31c<br /> 096ffbac 72ef31cc iertutil!_IsoThreadProc_WrapperToReleaseScope+0xe<br /> 096ffbd8 7696338a IEShims!NS_CreateThread::DesktopIE_ThreadProc+0x71<br /> 096ffbe4 77c39f72 kernel32!BaseThreadInitThunk+0xe<br /> 096ffc24 77c39f45 ntdll!__RtlUserThreadStart+0x70<br /> 096ffc3c 00000000 ntdll!_RtlUserThreadStart+0x1b<br /> <br /> edi comes from...<br /> 0:007&gt; !heap -p -a edi<br /> address 0e714fd0 found in<br /> _DPH_HEAP_ROOT @ 2c61000<br /> in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize)<br /> e611340: e714fd0 2c - e714000 2000<br /> 72a78e89 verifier!AVrfDebugPageHeapAllocate+0x00000229<br /> 77cd0d96 ntdll!RtlDebugAllocateHeap+0x00000030<br /> 77c8af0d ntdll!RtlpAllocateHeap+0x000000c4<br /> 77c33cfe ntdll!RtlAllocateHeap+0x0000023a<br /> 6e5af33f MSHTML!CHtmRootParseCtx::AddText+0x00000460<br /> 6e5aef8b MSHTML!CHtmRootParseCtxRouter::AddText+0x0000001d<br /> 6e5333f0 MSHTML!CInsertionMode::HandleCharacterToken+0x0000005b<br /> 6e5347b6 MSHTML!CHtml5Tokenizer::RCDATALessThanSign_StateHandler+0x000000c7<br /> 6e5b4455 MSHTML!CHtml5Tokenizer::ParseBuffer+0x0000023c<br /> 6e5b4be7 MSHTML!CHtml5Parse::ParseToken+0x0000010e<br /> 6e5ac7c9 MSHTML!CHtmPost::ProcessTokens+0x000001d2<br /> 6e5abbbf MSHTML!CHtmPost::Exec+0x0000017f<br /> 6e427ec9 MSHTML!CHtmPost::Run+0x0000001c<br /> 6e427e4d MSHTML!PostManExecute+0x00000061<br /> 6e428daf MSHTML!PostManResume+0x0000007b<br /> 6e432e3c MSHTML!CDwnChan::OnMethodCall+0x00000019<br /> 6e380d01 MSHTML!GlobalWndOnMethodCall+0x0000012c<br /> 6e369a5a MSHTML!GlobalWndProc+0x00000115<br /> 75e362fa user32!InternalCallWinProc+0x00000023<br /> 75e36d3a user32!UserCallWinProcCheckWow+0x00000109<br /> 75e377c4 user32!DispatchMessageWorker+0x000003bc<br /> 75e3788a user32!DispatchMessageW+0x0000000f<br /> 7148bdfc IEFRAME!CTabWindow::_TabWindowThreadProc+0x00000445<br /> 715d602f IEFRAME!LCIETab_ThreadProc+0x0000031c<br /> 7649d14c iertutil!_IsoThreadProc_WrapperToReleaseScope+0x0000000e<br /> 72ef31cc IEShims!NS_CreateThread::DesktopIE_ThreadProc+0x00000071<br /> 7696338a kernel32!BaseThreadInitThunk+0x0000000e<br /> 77c39f72 ntdll!__RtlUserThreadStart+0x00000070<br /> 77c39f45 ntdll!_RtlUserThreadStart+0x0000001b<br /> &lt;/pre&gt;</div> Pwnwiki