2199 matches found
Microsoft Edge Chakra - NULL Pointer Dereference
Microsoft Edge Chakra - NULL Pointer Dereference spreadIndices = nullptr // This function emits the arguments for a call. // ArgOut's with uses immediately following defs. EmitArgListStartthisLocation, byteCodeGenerator, funcInfo, callSiteId; Js::RegSlot evalLocation = Js::Constants::NoRegister; ...
Microsoft Chakra JIT Server Out-Of-Bounds Write Exploit
The Microsoft Chakra JIT server suffers from an out-of-bounds write when processing a Js::OpCode::ProfiledLoopStart opcode. Microsoft Chakra JIT server out-of-bounds write when processing Js::OpCode::ProfiledLoopStart opcode CVE-2017-8659 There is an issue in Chakra JIT server that can be...
Microsoft Chakra JIT Server IRBuilder::Build Integer Overflow Exploit
The Microsoft Chakra JIT server suffers from an integer overflow in IRBuilder::Build. Microsoft Chakra JIT server integer overflow in IRBuilder::Build CVE-2017-8637 There is an issue in Chakra JIT server that can be potentially exploited to compromise the JIT process from a compromised browser...
Microsoft Edge Chakra TryUndeleteProperty Incorrect Usage Exploit
Microsoft Edge Chakra suffers from an incorrect usage of TryUndeleteProperty. Microsoft Edge: Chakra: Incorrect usage of TryUndeleteProperty CVE-2017-8635 Chakra implemented the reuse of deleted properties of an unordered dictionary object with the following code. bool...
Microsoft Edge Chakra Uninitialized Arguments Exploit
Microsoft Edge Chakra suffers from an uninitialized arguments vulnerability. Microsoft Edge: Chakra: Uninitialized arguments CVE-2017-8640 Here's a snippet of "ParseVariableDeclaration" which is used for parsing declarations. template ParseNodePtr Parser::ParseVariableDeclaration tokens...
Microsoft Edge Chakra Parser::ParseFncFormals Uninitialized Arguments Exploit
Microsoft Edge Chakra suffers from an uninitialized arguments vulnerability in Parser::ParseFncFormals with the "PNodeFlags::fpnArgumentsoverriddenInParam" flag. Microsoft Edge: Chakra: Uninitialized arguments 2 CVE-2017-8670 Similar to the issue 1297 . But this time, it happends in...
Microsoft Edge Chakra JavascriptFunction::EntryCall Mishandled CallInfo
Microsoft Edge: Chakra: JavascriptFunction::EntryCall doesn't handle CallInfo properly CVE-2017-8671 Here's the method. Var JavascriptFunction::EntryCallRecyclableObject function, CallInfo callInfo, ... PROBESTACKfunction-GetScriptContext, Js::Constants::MinStackDefault; RUNTIMEARGUMENTSargs,...
Microsoft Edge: Chakra: Uninitialized arguments 2(CVE-2017-8670)
Similar to the issue 1297 . But this time, it happends in "Parser::ParseFncFormals" with the "PNodeFlags::fpnArgumentsoverriddenInParam" flag. template void Parser::ParseFncFormalsParseNodePtr pnodeFnc, ParseNodePtr pnodeParentFnc, ushort flags ... if IsES6DestructuringEnabled &&...
Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability(CVE-2017-8656)
function trigger try catch x var x = 1; printx; trigger; When Chakra executes the above code, it declares two "x"s. One is only for the catch scope, the other is for the whole function scope. The one for the whole function scope is initialized with undefined at the start of the function. If the...
Microsoft Edge: Chakra: InterpreterStackFrame::ProcessLinkFailedAsmJsModule incorrectly re-parses(CVE-2017-8645)
When Chakra fails to link an asmjs module, it tries to re-parse the failed-to-link asmjs function to treat it as a normal javascript function. But it incorrectly handles the case where the function is a class. It starts to parse from the start of the class declaration instead of the constructor. ...
Microsoft Edge Chakra - NULL Pointer Dereference
spreadIndices = nullptr // This function emits the arguments for a call. // ArgOut's with uses immediately following defs. EmitArgListStartthisLocation, byteCodeGenerator, funcInfo, callSiteId; Js::RegSlot evalLocation = Js::Constants::NoRegister; // // If Emitting arguments for eval and assignin...
Microsoft Edge Chakra - Uninitialized Arguments (1)
ParseNodePtr Parser::ParseVariableDeclaration tokens declarationType, charcountt ichMin, BOOL fAllowIn/ = TRUE/, BOOL pfForInOk/ = nullptr/, BOOL singleDefOnly/ = FALSE/, BOOL allowInit/ = TRUE/, BOOL isTopVarParse/ = TRUE/, BOOL isFor/ = FALSE/, BOOL nativeForOk /= nullptr/ ... if pid ==...
Microsoft Edge Chakra - Uninitialized Arguments (2)
void Parser::ParseFncFormalsParseNodePtr pnodeFnc, ParseNodePtr pnodeParentFnc, ushort flags ... if IsES6DestructuringEnabled && IsPossiblePatternStart ... // Instead of passing the STFormal all the way on many methods, it seems it is better to change the symbol type afterward. for ParseNodePtr...
Microsoft Edge Chakra - 'InterpreterStackFrame::ProcessLinkFailedAsmJsModule' Incorrect Usage of 'PushPopFrameHelper' (Denial of Service)
GetScriptContext-GetThreadContext-GetLeafInterpreterFrame; GetLoopHeaderinterpreterFrame-GetCurrentLoopNum; GetCurrentLoopNum == -1 ... PoC: -- function asmModule 'use asm'; let a = 1, 2, 3, 4; for let i = 0; i 0x100000; i++ // JIT a0 = 1; if i === 0x30000 a0 = ; // the array type changed,...
Microsoft Edge: Chakra: Type confusion in JavascriptArray::ConcatArgs(CVE-2017-8634)
Let's assume that the following method is called with "firstPromotedItemIsSpreadable = true", and "args" has two elements an array and an integer 0x1234 sequentially. In the first loop, "aItem" is an array, and "firstPromotedItemIsSpreadable" remains true because the condition for the fast path i...
Microsoft Edge Chakra TryUndeleteProperty Incorrect Usage
Microsoft Edge: Chakra: Incorrect usage of TryUndeleteProperty CVE-2017-8635 Chakra implemented the reuse of deleted properties of an unordered dictionary object with the following code. bool SimpleDictionaryUnorderedTypeHandler::TryReuseDeletedPropertyIndex DynamicObject const object,...
Microsoft Edge Chakra Incorrect Jit Optimization
Microsoft Edge: Chakra: incorrect jit optimization with TypedArray setter 2 CVE-2017-8548 I think the fix for 1045 is incorrect. Here's the original PoC. 'use strict'; function funca, b, c a0 = 1.2; b0 = c; a1 = 2.2; a0 = 2.3023e-320; function main var a = 1.1, 2.2; var b = new Uint32Array100; //...
Microsoft Edge Charka PreVisitCatch Missing Call
Microsoft Edge: Chakra: PreVisitCatch doesn't call SetIsCatch for all cases CVE-2017-8656 function trigger try catch x var x = 1; printx; trigger; When Chakra executes the above code, it declares two "x"s. One is only for the catch scope, the other is for the whole function scope. The one for the...
Microsoft Edge Chakra PushPopFrameHelper Incorrect Usage
Microsoft Edge: Chakra: Incorrect usage of PushPopFrameHelper in InterpreterStackFrame::ProcessLinkFailedAsmJsModule CVE-2017-8646 PushPopFrameHelper is a class that pushes the current stack frame object in its constructor and pops it in the destructor. So it should be used like "PushPopFrameHelp...
