WebKit JSC JSObject::putInlineSlow / JSValue::putToPrimitive XSS Vulnerability

WebKit JSC JSObject::putInlineSlow and JSValue::putToPrimitive suffer from a universal cross site scripting vulnerability. WebKit: JSC: UXSS via JSObject::putInlineSlow and JSValue::putToPrimitive CVE-2017-7037 JSObject::putInlineSlow and JSValue::putToPrimitive use getPrototypeDirect instead of...

WebKit JSC ArgumentsEliminationPhase::transform Incorrect LoadVarargs Handling

WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform CVE-2017-7056 Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if candidate-op == PhantomNewArrayWithSpread || candidate-op == PhantomSpread ... if argumentCountIncludingThis limit...

WebKit JSC JSObject::putInlineSlow / JSValue::putToPrimitive XSS

WebKit: JSC: UXSS via JSObject::putInlineSlow and JSValue::putToPrimitive CVE-2017-7037 JSObject::putInlineSlow and JSValue::putToPrimitive use getPrototypeDirect instead of getPrototype to get an object's prototype. So JSDOMWindow::getPrototype which checks the Same Origin Policy is not called...

WebKit JSC arrayProtoFuncSplice Uninitiailzed Memory Reference Vulnerability

WebKit JSC suffers from an uninitialized memory reference in arrayProtoFuncSplice. WebKit: JSC: uninitialized memory reference in arrayProtoFuncSplice Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result =...

WebKit JSC ArgumentsEliminationPhase::transform Incorrect LoadVarargs Handling Vulnerability

WebKit JSC suffers from incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform. WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform CVE-2017-7056 Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if candidate-op ==...

WebKit JSC - JSArray::appendMemcpy Uninitialized Memory Copy

WebKit JSC - JSArray::appendMemcpy Uninitialized Memory Copy indexingType; if type == ArrayWithUndecided && copyType != NonArray if copyType == ArrayWithInt32 convertUndecidedToInt32vm; else if copyType == ArrayWithDouble convertUndecidedToDoublevm; else if copyType == ArrayWithContiguous...

WebKit JSC - 'arrayProtoFuncSplice' Uninitialized Memory Reference

lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if UNLIKELY!result throwOutOfMemoryErrorexec, scope; return encodedJSValue; // The result can have an ArrayStorage indexing type if we're having a bad time. bool isArrayStorage =...

WebKit JSC - 'DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry)' Incorrect Scope Register Handling

scopeRegister; mcodeBlock| instead of |mcodeBlock|. But it doesn't. As a result, the scope register of |inlineStackEntry-mcodeBlock| may have an incorrect offset in the stack layout phase. PoC: -- function f function eval'1'; f; ; throw 1; f;...

WebKit JSC - 'JSObject::putInlineSlow' / 'JSValue::putToPrimitive' Universal Cross-Site Scripting

let f = document.body.appendChilddocument.createElement'iframe'; let loc = f.contentWindow.location; f.onload = = let a = 1.2; a.proto.proto = f.contentWindow; a'test' = toString: function arguments.callee.caller.constructor'alertlocation'; ; ; f.src = 'data:text/html,' +...

WebKit JSC - 'JSArray::appendMemcpy' Uninitialized Memory Copy

indexingType; if type == ArrayWithUndecided && copyType != NonArray if copyType == ArrayWithInt32 convertUndecidedToInt32vm; else if copyType == ArrayWithDouble convertUndecidedToDoublevm; else if copyType == ArrayWithContiguous convertUndecidedToContiguousvm; else ASSERTcopyType ==...

WebKit JSC - 'ArgumentsEliminationPhase::transform' Incorrect LoadVarargs Handling

op == PhantomNewArrayWithSpread || candidate-op == PhantomSpread ... if argumentCountIncludingThis limit storeArgumentCountIncludingThisargumentCountIncludingThis; // store arguments ... node-remove; node-origin.exitOK = canExit; break; Whether or not the "argumentCountIncludingThis limit"...

WebKit JSC - 'ObjectPatternNode::appendEntry' Stack Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1256 Here's a snippet of ObjectPatternNode::appendEntry. void appendEntryconst JSTokenLocation&, ExpressionNode propertyExpression, DestructuringPatternNode pattern, ExpressionNode defaultValue, BindingType bindingType...

WebKit - 'WebCore::getCachedWrapper' Use-After-Free

function freememory var a; forvar i=0;i ::get const /Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Ver...

WebKit JSC - JSGlobalObject::haveABadTime Causes Type Confusions Exploit

Exploit for multiple platform in category dos / poc switchToSlowPutArrayStoragevm; = MINSPARSEARRAYINDEX || structurevm-holesMustForwardToPrototypevm return nullptr; Structure...

WebKit JSC - arrayProtoFuncSplice does not Initialize all Indices Exploit

Exploit for multiple platform in category dos / poc lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if !result return JSValue::encodethrowOutOfMemoryErrorexec, scope; for unsigned k = 0; k initializeIndexvm, k, v;...

WebKit JSC - Heap Buffer Overflow in Intl.getCanonicalLocales Exploit

Exploit for multiple platform in category dos / poc arrayStorage; storage-msparseMap.clear; storage-mindexBias = 0; storage-mnumValuesInVector = 0; return butterfly; It allocates a fixed sizeBASEARRAYSTORAGEVECTORLEN of memory without caring about |initialLength|. So a BOF occurs in the following...

WebKit JSC - JIT Optimization Check Failed in IntegerCheckCombiningPhase::handleBlock Exploit

Exploit for multiple platform in category dos / poc range.mmaxBound range.mmaxBound = data.maddend; range.mmaxOrigin = node-origin.semantic; else if data.maddend origin.semantic; ... The problem is that the check |data.maddend range.mmaxBound| is a signed comparison. PoC: -- function f let arr = ...

WebKit JSC - arrayProtoFuncSplice does not Initialize all Indices

WebKit JSC - arrayProtoFuncSplice does not Initialize all Indices lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if !result return JSValue::encodethrowOutOfMemoryErrorexec, scope; for unsigned k = 0; k initializeIndexvm, k, v;...

WebKit JSC - 'Intl.getCanonicalLocales' Heap Buffer Overflow

arrayStorage; storage-msparseMap.clear; storage-mindexBias = 0; storage-mnumValuesInVector = 0; return butterfly; It allocates a fixed sizeBASEARRAYSTORAGEVECTORLEN of memory without caring about |initialLength|. So a BOF occurs in the following iteration. EncodedJSValue JSCHOSTCALL...

WebKit JSC - Intl.getCanonicalLocales Heap Buffer Overflow

WebKit JSC - Intl.getCanonicalLocales Heap Buffer Overflow arrayStorage; storage-msparseMap.clear; storage-mindexBias = 0; storage-mnumValuesInVector = 0; return butterfly; It allocates a fixed sizeBASEARRAYSTORAGEVECTORLEN of memory without caring about |initialLength|. So a BOF occurs in the...