PT-2023-36470

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60538 Crash type: Heap-buffer-overflow READ 4 Crash state: llvm::DataLayout::getIndexedOffsetInType InterpreterStackFrame::ResolveConstantValue InterpreterStackFrame::EvaluateValue...

PT-2022-37741

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45591 Crash type: Heap-buffer-overflow READ 4 Crash state: llvm::DataLayout::getIndexedOffsetInType InterpreterStackFrame::ResolveConstantValue InterpreterStackFrame::EvaluateValue...

lldb-eval:lldb_vs_lldb_eval_libfuzzer_test: Heap-buffer-overflow in llvm::DataLayout::getIndexedOffsetInType

Detailed Report: https://oss-fuzz.com/testcase?key=6363430154534912 Project: lldb-eval Fuzzing Engine: libFuzzer Fuzz Target: lldbvslldbevallibfuzzertest Job Type: libfuzzerasanlldb-eval Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60c0000c2dc0 Crash State:...

lldb-eval:lldb_vs_lldb_eval_libfuzzer_test: Heap-buffer-overflow in llvm::DataLayout::getIndexedOffsetInType

Detailed Report: https://oss-fuzz.com/testcase?key=5737924226842624 Project: lldb-eval Fuzzing Engine: libFuzzer Fuzz Target: lldbvslldbevallibfuzzertest Job Type: libfuzzerasanlldb-eval Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60800007c980 Crash State:...

Microsoft Edge Chakra JIT - Scope Parsing Type Confusion Exploit

Exploit for windows platform in category dos / poc // PoC: async function triggera = class b await 1 let spray = ; for let i = 0; i 0016 SetHomeObj R13 R14 001b NewScObjectSimple R9 001d ProfiledStFld R9.value = R2 1 0021 ProfiledStFld R9.done = R4 2 0025 Yield R9 R9...

Microsoft Edge Chakra JIT - Parameter Scope Parsing Type Confusion

Microsoft Edge Chakra JIT - Parameter Scope Parsing Type Confusion // PoC: async function triggera = class b await 1 let spray = ; for let i = 0; i 0016 SetHomeObj R13 R14 001b NewScObjectSimple R9 001d ProfiledStFld R9.value = R2 1 0021 ProfiledStFld R9.done = R4 2 0025 Yield R9 R9...

Microsoft Edge Chakra JIT - Parameter Scope Parsing Type Confusion

// PoC: async function triggera = class b await 1 let spray = ; for let i = 0; i 0016 SetHomeObj R13 R14 001b NewScObjectSimple R9 001d ProfiledStFld R9.value = R2 1 0021 ProfiledStFld R9.done = R4 2 0025 Yield R9 R9 0037 InitClassMemberComputedName R14R15...

Microsoft Edge Chakra JavascriptFunction::ReparseAsmJsModule Parsing Issue

Microsoft Edge: Chakra: JavascriptFunction::ReparseAsmJsModule incorrectly re-parses CVE-2017-8755 This is similar to the issue 1271 . Here's the method used to re-parse asmjs modules. void JavascriptFunction::ReparseAsmJsModuleScriptFunction functionRef ParseableFunctionInfo functionInfo =...

Microsoft Edge Chakra Heap Buffer Overflow

IsCoroutine ... else InterpreterStackFrame::Setup setupfunction, args; sizet varAllocCount = setup.GetAllocationVarCount; //printf"varAllocCount: %d%X\r\n", varAllocCount, varAllocCount; sizet varSizeInBytes = varAllocCount sizeofVar; // // Allocate a new InterpreterStackFrame instance on the...

Microsoft Edge: Chakra: Incorrect usage of PushPopFrameHelper in InterpreterStackFrame::ProcessLinkFailedAsmJsModule(CVE-2017-8646)

PushPopFrameHelper is a class that pushes the current stack frame object in its constructor and pops it in the destructor. So it should be used like "PushPopFrameHelper holder...", but InterpreterStackFrame::ProcessLinkFailedAsmJsModule uses it like a function. Var...

Microsoft Edge Chakra PushPopFrameHelper Incorrect Usage Exploit

Microsoft Edge Chakra suffers from an incorrect usage of PushPopFrameHelper in InterpreterStackFrame::ProcessLinkFailedAsmJsModule. Microsoft Edge: Chakra: Incorrect usage of PushPopFrameHelper in InterpreterStackFrame::ProcessLinkFailedAsmJsModule CVE-2017-8646 PushPopFrameHelper is a class that...

Microsoft Edge Chakra - Heap Buffer Overflow

Microsoft Edge Chakra - Heap Buffer Overflow IsCoroutine ... else InterpreterStackFrame::Setup setupfunction, args; sizet varAllocCount = setup.GetAllocationVarCount; //printf"varAllocCount: %d%X\r\n", varAllocCount, varAllocCount; sizet varSizeInBytes = varAllocCount sizeofVar; // // Allocate a...

Microsoft Edge Chakra - 'InterpreterStackFrame::ProcessLinkFailedAsmJsModule' Incorrectly Re-parses

GetOriginalEntryPoint : nullptr; if this-pCurrentFunction && this-pCurrentFunction-IsFunctionParsed Assertthis-pCurrentFunction-StartInDocument == pnode-ichMin; pCurrentFunction" is the consturctor, but "pnode" refers to the method "f". PoC: -- class MyClass fa printa; constructor 'use asm';...

Microsoft Edge Chakra - 'InterpreterStackFrame::ProcessLinkFailedAsmJsModule' Incorrect Usage of 'PushPopFrameHelper' (Denial of Service)

GetScriptContext-GetThreadContext-GetLeafInterpreterFrame; GetLoopHeaderinterpreterFrame-GetCurrentLoopNum; GetCurrentLoopNum == -1 ... PoC: -- function asmModule 'use asm'; let a = 1, 2, 3, 4; for let i = 0; i 0x100000; i++ // JIT a0 = 1; if i === 0x30000 a0 = ; // the array type changed,...

Microsoft Edge Chakra - Heap Buffer Overflow

IsCoroutine ... else InterpreterStackFrame::Setup setupfunction, args; sizet varAllocCount = setup.GetAllocationVarCount; //printf"varAllocCount: %d%X\r\n", varAllocCount, varAllocCount; sizet varSizeInBytes = varAllocCount sizeofVar; // // Allocate a new InterpreterStackFrame instance on the...

Microsoft Edge Chakra PushPopFrameHelper Incorrect Usage

Microsoft Edge: Chakra: Incorrect usage of PushPopFrameHelper in InterpreterStackFrame::ProcessLinkFailedAsmJsModule CVE-2017-8646 PushPopFrameHelper is a class that pushes the current stack frame object in its constructor and pops it in the destructor. So it should be used like "PushPopFrameHelp...