Microsoft Edge Chakra JIT BoundFunction::NewInstance Bug

🗓️ 12 Jul 2018 00:00:00Reported by Google Security ResearchType

packetstorm🔗 packetstormsecurity.com👁 28 Views

Microsoft Edge Chakra BoundFunction::NewInstance Bu

Reporter	Title	Published	Views	Family All 41
0day.today	Microsoft Edge Chakra JIT - BoundFunction::NewInstance Out-of-Bounds Read Exploit	12 Jul 201800:00	–	zdt
BDU FSTEC	The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser, caused by an operation that goes beyond the buffer in memory, allows attackers to execute arbitrary code.	29 Jun 201800:00	–	bdu_fstec
Circl	CVE-2018-8139	12 Jul 201800:00	–	circl
CNVD	Microsoft ChakraCore and Edge Remote Code Execution Vulnerability (CNVD-2018-10202)	9 May 201800:00	–	cnvd
Check Point Advisories	Microsoft Edge Out Of Bounds Read (CVE-2018-8139)	12 Jul 201800:00	–	checkpoint_advisories
CVE	CVE-2018-8139	9 May 201819:00	–	cve
Cvelist	CVE-2018-8139	9 May 201819:00	–	cvelist
EUVD	EUVD-2022-4070	9 May 201819:00	–	euvd
EUVD	EUVD-2022-5586	9 May 201819:00	–	euvd
Github Security Blog	ChakraCore RCE Vulnerability	13 May 202201:20	–	github

`Microsoft Edge: Chakra: A bug in BoundFunction::NewInstance   
  
CVE-2018-8139  
  
  
BoundFunction::NewInstance is used to handle calls to a bound function. The method first allocates a new argument array and copies the prepended arguments and others into the new argument array and calls the actual function. The problem is, it doesn't care about the CallFlags_NewTarget flag which indicates that there's an extra argument (new.target) at the end of the argument array. So the size of the new argument array created with the CallFlags_NewTarget flag will be always 1 less then required, this leads to an OOB read.  
  
PoC:  
function func() {  
new.target.x;  
}  
  
let bound = func.bind({}, 1);  
  
Reflect.construct(bound, []);  
  
  
  
This bug is subject to a 90 day disclosure deadline. After 90 days elapse  
or a patch has been made broadly available, the bug report will become  
visible to the public.  
  
  
  
  
Found by: lokihardt  
  
`

12 Jul 2018 00:00Current

EPSS0.76997