CVE-2015-0071

What Is ASLR in Internet Explorer?

Address Space Layout Randomization (ASLR) is a security mitigation that randomizes the memory addresses of executable code, stack, heap, and libraries each time a process starts. ASLR prevents attackers from reliably predicting where their shellcode or return-oriented programming (ROP) gadgets will be in memory — without knowing the layout, memory corruption exploits fail because the attacker cannot target a predictable address.

IE-specific ASLR bypasses are among the most valuable components of browser exploit chains. An ASLR bypass does not itself execute code — it leaks memory addresses that make a paired memory corruption exploit reliable. The CVSS score of 6.5 (Medium) understates operational impact because ASLR bypasses are essential enablers for fully weaponized browser exploitation.

Overview

CVE-2015-0071 is an ASLR bypass vulnerability in Internet Explorer that allows a remote attacker, via a crafted web site, to discover memory addresses of IE modules or heap allocations. With the memory layout known, other IE vulnerabilities (memory corruption, use-after-free) that would otherwise fail due to address unpredictability become reliably exploitable. Patched in MS15-009 (February 10, 2015).

Affected Versions

Fixed in MS15-009 (February 2015 cumulative IE update).

Technical Details

Root Cause: Memory Address Disclosure

CVE-2015-0071 involves a code path in Internet Explorer that exposes internal memory address information to JavaScript or to a crafted DOM element in ways that bypass ASLR's address space randomization. When certain IE objects are created, manipulated, or queried, a pointer value or object address leaks into a context visible to an attacker's JavaScript.

A typical ASLR bypass attack flow:

1. Attacker serves a malicious web page — the page contains JavaScript that triggers the leak condition
2. IE leaks a memory address — a pointer to an IE module (e.g., mshtml.dll) or heap allocation is returned in a way the script can observe
3. Attacker calculates base addresses — using the leaked address and known module layout, the attacker computes the full memory map of the IE process
4. ROP chain succeeds — a paired RCE exploit (use-after-free, type confusion, etc.) uses the calculated addresses to build a working return-oriented programming chain that bypasses DEP/NX
5. Full code execution achieved — the combined exploit delivers reliable code execution

Pairing With IE RCE Vulnerabilities

In February 2015, MS15-009 also patched multiple IE memory corruption vulnerabilities. ASLR bypasses are routinely combined with these in full exploit chains. Exploit kits (Angler, Nuclear, Magnitude) in this period maintained paired ASLR-bypass + RCE modules for IE.

Attack Characteristics

Discovery

Reported to Microsoft and patched in the February 2015 cumulative Internet Explorer security update (MS15-009), which addressed both ASLR bypass and memory corruption vulnerabilities in IE 6 through 11.

Exploitation Context

• Exploit kit integration: ASLR bypasses for IE were rapidly adopted by commercial exploit kits in 2015; Angler and Nuclear both maintained current IE ASLR bypass modules to maximize reliability of their IE memory corruption payloads
• APT browser chains: Nation-state actors conducting watering hole attacks against targeted organizations used paired ASLR bypass + memory corruption chains for fully reliable browser-based compromise
• CISA KEV (2022): Added May 2022, reflecting exploitation of the IE vulnerability class against unpatched legacy IE deployments

Remediation

1. Apply MS15-009 (February 2015 cumulative IE update).

2. Retire Internet Explorer — Microsoft ended IE support June 15, 2022. No further patches exist for any IE vulnerability. Migrate to Microsoft Edge (Chromium) or another supported browser.

3. Enable Enhanced Protected Mode (EPM) in IE 10/11 — EPM's AppContainer isolation limits the usefulness of ASLR bypass by adding further sandboxing even if memory addresses are leaked.

4. Block IE via Group Policy or AppLocker if migration cannot be completed immediately.