WebKit: JSC: Incorrect for-in optimization #2(CVE-2017-7117)

No description provided by source. The following PoC bypasses the fix for the https://www.seebug.org/vuldb/ssvid-96629. PoC: function f let o = ; for let i in xx: 0 for i of 0 printoi; f;...

WebKit JSC - 'BytecodeGenerator::emitGetByVal' Incorrect Optimization (2)

function f let o = ; for let i in xx: 0 for i of 0 printoi; f;...

WebKit JSC - BytecodeGenerator::emitGetByVal Incorrect Optimization (2)

WebKit JSC - BytecodeGenerator::emitGetByVal Incorrect Optimization 2 function f let o = ; for let i in xx: 0 for i of 0 printoi; f;...

WebKit JSC Incorrect Optimization Vulnerability

A proof of concept has been released that bypasses the fix for the original finding regarding an incorrect optimization in BytecodeGenerator::emitGetByVal in WebKit JSC. WebKit: JSC: Incorrect for-in optimization 2 CVE-2017-7117 The following PoC bypasses the fix for the...

WebKit JSC Incorrect Optimization

WebKit: JSC: Incorrect for-in optimization 2 CVE-2017-7117 The following PoC bypasses the fix for the https://bugs.chromium.org/p/project-zero/issues/detail?id=1263 WebKit: JSC: Incorrect optimization in BytecodeGenerator::emitGetByVal PoC: function f let o = ; for let i in xx: 0 for i of 0...

WebKit JSC - BytecodeGenerator::emitGetByVal Incorrect Optimization (1)

WebKit JSC - BytecodeGenerator::emitGetByVal Incorrect Optimization 1 Let's start with JS code. let o = ; for let i in xx: 0 oi; 0; i-- ForInContext& context = mforInContextStacki - 1.get; if context.local != property continue; if !context.isValid break; if context.type ==...

WebKit JSC BytecodeGenerator::emitGetByVal Incorrect Optimization Exploit

Exploit for multiple platform in category dos / poc WebKit: JSC: Incorrect optimization in BytecodeGenerator::emitGetByVal CVE-2017-7061 Let's start with JS code. let o = ; for let i in xx: 0 oi; 0; i-- ForInContext& context = mforInContextStacki - 1.get; if context.local != property continue; if...

WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform(CVE-2017-7056)

Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if candidate-op == PhantomNewArrayWithSpread || candidate-op == PhantomSpread ... if argumentCountIncludingThis limit storeArgumentCountIncludingThisargumentCountIncludingThis; // store arguments ... node-remove;...

WebKit: JSC: uninitialized memory reference in arrayProtoFuncSplice

Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result = JSArray::tryCreateForInitializationPrivatevm, exec-lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if UNLIKELY!result...

WebKit: JSC: Incorrect scope register handling in DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry)

Here's a snippet of DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry. void flushInlineStackEntry inlineStackEntry ... if mgraph.needsScopeRegister flushmcodeBlock-scopeRegister; mcodeBlock| instead of |mcodeBlock|. But it doesn't. As a result, the scope register of...

WebKit: JSC: Stack-Use-After-Free in ObjectPatternNode::appendEntry

Here's a snippet of ObjectPatternNode::appendEntry. void appendEntryconst JSTokenLocation&, ExpressionNode propertyExpression, DestructuringPatternNode pattern, ExpressionNode defaultValue, BindingType bindingType mtargetPatterns.appendEntry Identifier, propertyExpression, false, pattern,...

WebKit: JSC: UXSS via JSObject::putInlineSlow and JSValue::putToPrimitive(CVE-2017-7037)

JSObject::putInlineSlow and JSValue::putToPrimitive use getPrototypeDirect instead of getPrototype to get an object's prototype. So JSDOMWindow::getPrototype which checks the Same Origin Policy is not called. The PoC shows to call a setter of another origin's object. PoC 1 -...

WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy(CVE-2017-7064)

WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy Here's a snippet of JSArray::appendMemcpy. bool JSArray::appendMemcpyExecState exec, VM& vm, unsigned startIndex, JSC::JSArray otherArray auto scope = DECLARETHROWSCOPEvm; if !canFastCopyvm, otherArray return false; IndexingType type =...

WebKit: use-after-free in WebCore::getCachedWrapper(CVE-2017-7040)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar i=0;i...

WebKit JSC ArgumentsEliminationPhase::transform Incorrect LoadVarargs Handling

WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform CVE-2017-7056 Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if candidate-op == PhantomNewArrayWithSpread || candidate-op == PhantomSpread ... if argumentCountIncludingThis limit...

WebKit JSC JSObject::putInlineSlow / JSValue::putToPrimitive XSS

WebKit: JSC: UXSS via JSObject::putInlineSlow and JSValue::putToPrimitive CVE-2017-7037 JSObject::putInlineSlow and JSValue::putToPrimitive use getPrototypeDirect instead of getPrototype to get an object's prototype. So JSDOMWindow::getPrototype which checks the Same Origin Policy is not called...

WebKit JSC - 'JSArray::appendMemcpy' Uninitialized Memory Copy

indexingType; if type == ArrayWithUndecided && copyType != NonArray if copyType == ArrayWithInt32 convertUndecidedToInt32vm; else if copyType == ArrayWithDouble convertUndecidedToDoublevm; else if copyType == ArrayWithContiguous convertUndecidedToContiguousvm; else ASSERTcopyType ==...

WebKit JSC - 'arrayProtoFuncSplice' Uninitialized Memory Reference

lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if UNLIKELY!result throwOutOfMemoryErrorexec, scope; return encodedJSValue; // The result can have an ArrayStorage indexing type if we're having a bad time. bool isArrayStorage =...

WebKit JSC - 'DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry)' Incorrect Scope Register Handling

scopeRegister; mcodeBlock| instead of |mcodeBlock|. But it doesn't. As a result, the scope register of |inlineStackEntry-mcodeBlock| may have an incorrect offset in the stack layout phase. PoC: -- function f function eval'1'; f; ; throw 1; f;...

WebKit JSC ObjectPatternNode::appendEntry Use-After-Free Vulnerability

WebKit JSC suffers from an ObjectPatternNode::appendEntry stack use-after-free. WebKit: JSC: Stack-Use-After-Free in ObjectPatternNode::appendEntry Here's a snippet of ObjectPatternNode::appendEntry. void appendEntryconst JSTokenLocation&, ExpressionNode propertyExpression, DestructuringPatternNo...