The Isolated Heap

While working on some IE 11 related UAF vulnerabilities, I noticed that there were significant changes in the new IDB.

The initialization function of MSHTML now has some additional code:

push    0               ; dwMaximumSize
push    0               ; dwInitialSize
push    0               ; flOptions
call    ds:__imp__HeapCreate@12 ; HeapCreate(x,x,x)
mov     _g_hIsolatedHeap, eax
test    eax, eax
jnz     short loc_63C94EC5
xor     esi, esi
jmp     loc_6358112F

A new heap is created and stored in a globally accessible way in _g_hIsolatedHeap.

A low fragmentation heap is then created with the new heap:

mov     ecx, eax
call    HeapSetInformation_LowFragmentation_Downlevel
jmp     loc_63A246BA

Object Allocation

Allocations are currently done from two functions:

• _MemIsolatedAlloc
• _MemIsolatedAllocClear

_MemIsolatedAllocClear

This simple wrapper around HeapAlloc will allocate a heap block with the memory zero'd out:

LPVOID _MemIsolatedAllocClear(SIZE_T dwBytes)
{
    //HEAP_ZERO_MEMORY
    return HeapAlloc(g_hIsolatedHeap, 0x8, dwBytes);
}

_MemIsolatedAlloc

LPVOID _MemIsolatedAlloc(SIZE_T dwBytes)
{
    //
    return HeapAlloc(g_hIsolatedHeap, 0, dwBytes);
}

Object Freeing

Every time an object that was created in this heap is freed, it is now first memset to zero and then freed. Here is an example of an object of size 0x34 being freed:

push    34h             ; Size
push    0               ; Val
push    esi             ; Dst
call    _memset
...
push    esi             ; lpMem
push    0               ; dwFlags
push    _g_hIsolatedHeap ; hHeap
call    _HeapFree@12    ; HeapFree(x,x,x)

Appendix

Based on a cursory look, here are a few objects allocated on the Isolated Heap:

There are more objects that are created on the Isolated Heap, but not listed here