Microsoft Edge Object.setPrototypeOf Memory Corruption

Microsoft Edge: Memory corruption with Object.setPrototypeOf CVE-2017-8751 I accidentally found this while trying to reproduce another bug in Edge. Failed to reproduce on Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393. Tested on Microsoft Edge 40.15063.0.0, Microsoft EdgeHTML 15.1506...

Microsoft Edge Information Disclosure Vulnerability (CNVD-2017-34920)

Microsoft Edge is the web browser built into the Windows 10 version. Microsoft Edge suffers from an information disclosure vulnerability in its implementation, which can be exploited by an unauthenticated, remote attacker to gain access to sensitive information on the target system...

Microsoft Edge: Chakra: JIT: Type confusion with switch statements(CVE-2017-11811)

Let's start with a switch statement and its IR code for JIT. JS: for let i = 0; i ; 100; i++ switch i case 2: case 4: case 6: case 8: case 10: case 12: case 14: case 16: case 18: case 20: case 22: case 24: case 26: case 28: case 30: case 32: case 34: case 36: case 38: break; IRs before Type...

Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability (CNVD-2017-36629)

Microsoft Edge is a popular browser. A remote memory corruption vulnerability exists in the Microsoft Edge scripting engine, which allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be parsed by the user with elevated privileges...

Microsoft Windows Edge ChakraCore Remote Code Execution Vulnerability

Microsoft Windows 10 is a next-generation cross-platform operating system released by Microsoft for PCs and laptops, tablets, and cell phones.Edge is one of the default browsers that comes with the system.ChakraCore is one of the Chakra JavaScript ChakraCore is the core of one of the Chakra...

Microsoft Edge: Chakra: JIT: Incorrect integer overflow check in Lowerer::LowerBoundCheck(CVE-2017-11861)

Here's a snippet of the method. void Lowerer::LowerBoundCheckIR::Instr const instr ... ifrightOpnd-IsIntConstOpnd IntConstType newOffset; if!IntConstMath::Addoffset, rightOpnd-AsIntConstOpnd-GetValue, &newOffset --- a offset = newOffset; rightOpnd = nullptr; offsetOpnd = nullptr; ... if!rightOpnd...

Microsoft Edge Chakra JIT Type Confusion

Microsoft Edge: Chakra: JIT: Type confusion with switch statements CVE-2017-11811 Let's start with a switch statement and its IR code for JIT. JS: for let i = 0; i 100; i++ switch i case 2: case 4: case 6: case 8: case 10: case 12: case 14: case 16: case 18: case 20: case 22: case 24: case 26: ca...

Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CNVD-2017-34924)

Microsoft Edge is the web browser built into the Windows 10 version. A memory corruption vulnerability exists in the implementation of the Microsoft Edge scripting engine, which allows an unauthenticated, remote attacker to execute arbitrary code on the target system...

Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CNVD-2017-34923)

Microsoft Edge is the web browser built into the Windows 10 version. A memory corruption vulnerability exists in the implementation of the Microsoft Edge scripting engine, which can be exploited by an unauthenticated, remote attacker to execute arbitrary code on the target system...

Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CNVD-2017-34928)

Microsoft Edge is the web browser built into the Windows 10 version. A memory corruption vulnerability exists in the implementation of the Microsoft Edge scripting engine, which can be exploited by an unauthenticated, remote attacker to execute arbitrary code on the target system...

Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CNVD-2017-34922)

Microsoft Edge is the web browser built into the Windows 10 version. A memory corruption vulnerability exists in the implementation of the Microsoft Edge scripting engine, which can be exploited by an unauthenticated, remote attacker to execute arbitrary code on the target system...

Microsoft Edge Chakra: JIT - 'Lowerer::LowerBoundCheck' Incorrect Integer Overflow Check

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1343 Here's a snippet of the method. void Lowerer::LowerBoundCheckIR::Instr const instr ... ifrightOpnd-IsIntConstOpnd IntConstType newOffset; if!IntConstMath::Addoffset, rightOpnd-AsIntConstOpnd-GetValue, &newOffset --- a offset...

Microsoft Edge - Object.setPrototypeOf Memory Corruption Exploit

Exploit for windows platform in category dos / poc ,1::FindEntry+0x41: 00007fffe2b7c841 8b0c81 mov ecx,dword ptr rcx+rax4 ds:0000023b4a2ea4c4=???????? 0:015 k Child-SP RetAddr Call Site 00 000000be563fbba0 00007fffe2f52e3e chakra!JsUtil::WeaklyReferencedKeyDictionary,1::FindEntry+0x41 01...

Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability (CNVD-2017-36631)

Microsoft Edge is a popular browser. A remote memory corruption vulnerability exists in the Microsoft Edge scripting engine, which allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be parsed by the user with elevated privileges...

Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability (CNVD-2017-36630)

Microsoft Edge is a popular browser. A remote memory corruption vulnerability exists in the Microsoft Edge scripting engine, which allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be parsed by the user with elevated privileges...

Microsoft Internet Explorer/Edge Scripting Engine Memory Corruption Vulnerability (CNVD-2017-34717)

Internet Explorer is a web browser from Microsoft.Microsoft Edge is the web browser built into Windows 10 versions. A memory corruption vulnerability in the scripting engine implementation of Microsoft Edge/Microsoft Internet Explorer can be exploited by an unauthenticated, remote attacker to...

Microsoft Edge Memory Corruption Vulnerability (CNVD-2017-34926)

Microsoft Edge is the web browser built into the Windows 10 version. Microsoft Edge is implemented with a memory corruption vulnerability that can be exploited by unauthenticated, remote attackers to execute arbitrary code on the target system and corrupt memory...

Microsoft Edge: Memory corruption with Object.setPrototypeOf(CVE-2017-8751)

I accidentally found this while trying to reproduce another bug in Edge. Failed to reproduce on Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393. Tested on Microsoft Edge 40.15063.0.0, Microsoft EdgeHTML 15.15063 Insider Preview. Crash Log: First chance exceptions are reported before a...

Microsoft Edge Chakra: JIT - 'OP_Memset' Type Confusion

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1357 function opta, b, v if b.length b0 = ; return 0; ; printb0; main;...

Microsoft Edge Chakra JIT - Type Confusion with switch Statements

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1341&desc=3 Let's start with a switch statement and its IR code for JIT. JS: for let i = 0; i ; 100; i++ switch i case 2: case 4: case 6: case 8: case 10: case 12: case 14: case 16: case 18: case 20: case 22: case 24: case 26: ca...